CVE-2025-71162

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: tegra-adma: Fix use-after-free

A use-after-free bug exists in the Tegra ADMA driver when audio streams

are terminated, particularly during XRUN conditions. The issue occurs

when the DMA buffer is freed by tegra_adma_terminate_all() before the

vchan completion tasklet finishes accessing it.

The race condition follows this sequence:

1. DMA transfer completes, triggering an interrupt that schedules the

completion tasklet (tasklet has not executed yet)

2. Audio playback stops, calling tegra_adma_terminate_all() which

frees the DMA buffer memory via kfree()

3. The scheduled tasklet finally executes, calling vchan_complete()

which attempts to access the already-freed memory

Since tasklets can execute at any time after being scheduled, there is

no guarantee that the buffer will remain valid when vchan_complete()

runs.

Fix this by properly synchronizing the virtual channel completion:

- C

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References