In the Linux kernel, the following vulnerability has been resolved:
usb: phy: isp1301: fix non-OF device reference imbalance
A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301getclient() helper only increases the reference count for the returned I2C device in the OF case.
Increment the reference count also for non-OF so that the caller can decrement it unconditionally.
Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71145.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71145.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4b64fda4d30a83a7f00e92a0c8a1d47699609f3",
"digest": {
"length": 131.0,
"function_hash": "5213083248499976095028094126786432824"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c",
"function": "isp1301_get_client"
},
"id": "CVE-2025-71145-5323fcca"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7501ecfe3e5202490c2d13dc7e181203601fcd69",
"digest": {
"length": 131.0,
"function_hash": "5213083248499976095028094126786432824"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c",
"function": "isp1301_get_client"
},
"id": "CVE-2025-71145-6252c4b2"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d3df03f70547d4e3fc10ed4381c052eff51b157",
"digest": {
"length": 131.0,
"function_hash": "5213083248499976095028094126786432824"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c",
"function": "isp1301_get_client"
},
"id": "CVE-2025-71145-6ee4e129"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4b64fda4d30a83a7f00e92a0c8a1d47699609f3",
"digest": {
"line_hashes": [
"29142793931382053218181763400201117151",
"273913808895253973251964547278151396892",
"189710829331601165262212478233689917223",
"298792587867676788652072503756040245413"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c"
},
"id": "CVE-2025-71145-919d10ef"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03bbdaa4da8c6ea0c8431a5011db188a07822c8a",
"digest": {
"line_hashes": [
"29142793931382053218181763400201117151",
"273913808895253973251964547278151396892",
"189710829331601165262212478233689917223",
"298792587867676788652072503756040245413"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c"
},
"id": "CVE-2025-71145-94580b20"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e58abad6c08c5f0943594126ef4cd6559aac0b",
"digest": {
"length": 131.0,
"function_hash": "5213083248499976095028094126786432824"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c",
"function": "isp1301_get_client"
},
"id": "CVE-2025-71145-9950ca19"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7501ecfe3e5202490c2d13dc7e181203601fcd69",
"digest": {
"line_hashes": [
"29142793931382053218181763400201117151",
"273913808895253973251964547278151396892",
"189710829331601165262212478233689917223",
"298792587867676788652072503756040245413"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c"
},
"id": "CVE-2025-71145-9cd0b36b"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03bbdaa4da8c6ea0c8431a5011db188a07822c8a",
"digest": {
"length": 131.0,
"function_hash": "5213083248499976095028094126786432824"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c",
"function": "isp1301_get_client"
},
"id": "CVE-2025-71145-9e702a63"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75c5d9bce072abbbc09b701a49869ac23c34a906",
"digest": {
"line_hashes": [
"29142793931382053218181763400201117151",
"273913808895253973251964547278151396892",
"189710829331601165262212478233689917223",
"298792587867676788652072503756040245413"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c"
},
"id": "CVE-2025-71145-a910f532"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75c5d9bce072abbbc09b701a49869ac23c34a906",
"digest": {
"length": 131.0,
"function_hash": "5213083248499976095028094126786432824"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c",
"function": "isp1301_get_client"
},
"id": "CVE-2025-71145-b90b4971"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e58abad6c08c5f0943594126ef4cd6559aac0b",
"digest": {
"line_hashes": [
"29142793931382053218181763400201117151",
"273913808895253973251964547278151396892",
"189710829331601165262212478233689917223",
"298792587867676788652072503756040245413"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c"
},
"id": "CVE-2025-71145-ca61800e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d3df03f70547d4e3fc10ed4381c052eff51b157",
"digest": {
"line_hashes": [
"29142793931382053218181763400201117151",
"273913808895253973251964547278151396892",
"189710829331601165262212478233689917223",
"298792587867676788652072503756040245413"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/usb/phy/phy-isp1301.c"
},
"id": "CVE-2025-71145-fdc7129d"
}
]