CVE-2025-71145

In the Linux kernel, the following vulnerability has been resolved:

usb: phy: isp1301: fix non-OF device reference imbalance

A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301_get_client() helper only increases the reference count for the returned I2C device in the OF case.

Increment the reference count also for non-OF so that the caller can decrement it unconditionally.

Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use.

A Low impact use-after-free vulnerability was found in the Linux kernel's ISP1301 USB PHY driver. The isp1301_get_client() helper increments the reference count of the returned I2C device only in the device-tree (OF) case. A change fixing a device reference leak in a UDC driver then had callers drop that reference unconditionally, so in the non-OF case the last reference to the I2C device can be released while it is still in use, resulting in a potential use-after-free. The upstream fix increments the reference count in the non-OF case as well, allowing the caller to drop it unconditionally. Upstream notes that this code is inherently racy, since nothing prevents the PHY driver from being unbound while the returned I2C device is still in use. Triggering the issue requires local access on hardware that uses the ISP1301 USB transceiver through the non-device-tree code path. All Red Hat Enterprise Linux kernel and kernel-rt update streams are marked NOT AFFECTED with the justification that the vulnerable code is not present in the shipped kernels, so no Red Hat offerings are exposed. Although NIST and the CVE.org program assigned this flaw a CVSS 3.1 score of 7.8 (Important), the Red Hat Low impact rating reflects the niche hardware requirement, the local-access prerequisite, the racy nature of the bug, and the absence of the vulnerable code in Red Hat kernels.