CVE-2025-71272

MediumCVSS 5.5/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

most: core: fix resource leak in most_register_interface error paths

The function most_register_interface() did not correctly release resources if it failed early (before registering the device). In these cases, it returned an error code immediately, leaking the memory allocated for the interface.

Fix this by initializing the device early via device_initialize() and calling put_device() on all error paths.

The most_register_interface() is expected to call put_device() on error which frees the resources allocated in the caller. The put_device() either calls release_mdev() or dim2_release(), depending on the caller.

Switch to using device_add() instead of device_register() to handle the split initialization.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
May 6, 2026
Last modified
Oct 21, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-712735.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Simplify tCVE-2025-712744.7In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper ThCVE-2025-712766.1SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.CVE-2025-712788.8XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on anyCVE-2025-712799.8XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromiCVE-2025-71289.8A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown codCVE-2025-712805.5XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share aCVE-2025-712819.8XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter CVE-2025-712827.5XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker tCVE-2025-712849.8Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.CVE-2025-712855.5In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels MHI stCVE-2025-712865.5In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Correct the allocation size for bytes control
CVE-2025-71272: Medium severity, CVSS 5.5 | Vulnix