HIGH
iommu MediaTek Larb UAF
CVE-2025-71071
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers. Fix this by keeping the references as expected while the iommu driver is bound.
02KernelScan AI Analysis
Risk summary
A use-after-free bug in the MediaTek IOMMU driver could cause kernel crashes or memory corruption when the driver probe is deferred due to missing dependencies. This primarily affects system stability on MediaTek-based devices during boot or device hotplug scenarios.
Vulnerability analysis
Summary: Use-after-free vulnerability in MediaTek IOMMU driver during probe deferral
Root Cause: The MediaTek IOMMU driver was incorrectly dropping device references to larb (Local Arbiter) devices immediately after successful lookup during probe, even when the driver needed to retain those references. When a larb device had not yet been bound to its driver, causing the IOMMU driver probe to defer, the premature reference dropping could lead to the larb device being freed while the IOMMU driver still expected to use it later.
Attack Surface: This is a local vulnerability that occurs during device driver probe/initialization. It requires physical access to trigger device probe operations or the ability to cause driver probe deferrals through system configuration. The vulnerability is specific to MediaTek SoC platforms with IOMMU hardware and affects kernel stability rather than providing direct privilege escalation.
Fix Mechanism: The patch fixes the issue by removing the premature platform_device_put() calls that were dropping references immediately after device lookup. Instead, it keeps the references alive for the lifetime of the IOMMU driver binding and only releases them during driver removal or error cleanup paths. The fix adds proper reference cleanup in both the probe error path (err_larbdev_put) and the remove function.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.1 | 6.1.160 | 896ec55da3b9 |
| 6.12 | 6.12.64 | 1ef70a0b104a |
| 6.18 | 6.18.3 | f6c08d3aa441 |
| 6.6 | 6.6.120 | 5c04217d06a1 |
| mainline | 6.19 | de83d4617f9f |