CVE-2025-71199 iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
A use-after-free in the Linux kernel ADC driver allows local attackers to potentially execute code or escalate privileges via race conditions during module removal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71199?
CVE-2025-71199 is an use after free vulnerability in Linux, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq).
If we remove the module which will call at91_adc_remove to make cleanup, it will free indio_dev through iio_device_unregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| at91_adc_workq_handler at91_adc_remove | iio_device_unregister(indio_dev) | //free indio_dev a bit later | | iio_push_to_buffers(indio_dev) | //use indio_dev
Fix it by ensuring that the work is canceled before proceeding with the cleanup in at91_adc_remove.
Which versions are affected by CVE-2025-71199?
How do I fix CVE-2025-71199?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-71199 being exploited?
There is no known exploitation of CVE-2025-71199 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-71199, DEBIAN-CVE-2025-71199, GHSA-gf86-6w2v-6jr9, ROOT-OS-DEBIAN-11-CVE-2025-71199, ROOT-OS-DEBIAN-12-CVE-2025-71199, ROOT-OS-DEBIAN-13-CVE-2025-71199 and 3 more.