CVE-2025-71075

HighCVSS 7.8/10Last modified Nov 10, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: aic94xx: fix use-after-free in device removal path

The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability.

When a device removal is triggered (via hot-unplug or module unload), race condition can occur.

The fix adds tasklet_kill() before freeing the asd_ha structure, ensuring all scheduled tasklets complete before cleanup proceeds.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 2908d778ab3e244900c310974e1fc1c69066e450, < c8f6f88cd1df35155258285c4f43268b361819df; >= 2908d778ab3e244900c310974e1fc1c69066e450, < 278455a82245a572aeb218a6212a416a98e418de; >= 2908d778ab3e244900c310974e1fc1c69066e450, < b3e655e52b98a1d3df41c8e42035711e083099f8; >= 2908d778ab3e244900c310974e1fc1c69066e450, < e354793a7ab9bb0934ea699a9d57bcd1b48fc27b; >= 2908d778ab3e244900c310974e1fc1c69066e450, < a41dc180b6e1229ae49ca290ae14d82101c148c3; >= 2908d778ab3e244900c310974e1fc1c69066e450, < 751c19635c2bfaaf2836a533caa3663633066dcf; >= 2908d778ab3e244900c310974e1fc1c69066e450, < f6ab594672d4cba08540919a4e6be2e202b60007
LinuxLinux2.6.19
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.7, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *

References

Timeline

Published
Jan 13, 2026
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-710765.5In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA opeCVE-2025-710775.5In the Linux kernel, the following vulnerability has been resolved: tpm: Cap the number of PCR banks tpm2_get_pcr_allocation() does not caCVE-2025-710787.8In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems CVE-2025-710795.5In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_wriCVE-2025-71085.4A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7. Affected by this vulnerability is the fuCVE-2025-710805.5In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RTCVE-2025-710815.5In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to theCVE-2025-710827.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts comCVE-2025-710835.5In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Avoid NULL pointer deref for evicted BOs It is possible for aCVE-2025-710845.5In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID isCVE-2025-710855.5In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() CVE-2025-710867.8In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rose_kill_by_device() rose_kill_
CVE-2025-71075: High severity, CVSS 7.8 | Vulnix