What is CVE-2025-71082?

CVE-2025-71082 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 3.7 onward and patched in 5.15.198, 6.1.160, 6.6.120 and others. CVE-2025-71082 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2025-71082?

CVE-2025-71082 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2025-71082?

Yes, CVE-2025-71082 has been patched. Fixed versions include 5.15.198, 6.1.160, 6.6.120 and others. If you are running Linux kernel 3.7 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2025-71082 actively exploited?

CVE-2025-71082 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2025-71082

High

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces, ISOC and DIAG, this is an accident waiting to happen. The issue is revealed in btusb_disconnect(), where calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also being used by the other interfaces of the driver that may not be released yet. To fix this, revert the use of devm and go back to freeing memory explicitly.

Package Linux Kernel

Published 2026-01-13

Last modified 2026-03-25

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 3.7 and later are affected. Fixed in 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.4, 6.19 and their respective stable series.

Affected from

≥ 3.7

Fixed in

✓ 5.15.198 5.15.x ✓ 6.1.160 6.1.x ✓ 6.6.120 6.6.x ✓ 6.12.64 6.12.x ✓ 6.18.4 6.18.x ✓ 6.19

References

6 total

Kernel Git
https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339

Patch
Kernel Git
https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880

Patch
Kernel Git
https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b

Patch
Kernel Git
https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc

Patch
Kernel Git
https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003

Patch

Showing 5 of 6 references View all on NVD

Details

CVE ID CVE-2025-71082

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-01-13

Modified 2026-03-25

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2025-71082?

CVE-2025-71082 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 3.7 onward and has been patched in 5.15.198, 6.1.160, 6.6.120 and others. CVE-2025-71082 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2025-71082?

CVE-2025-71082 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2025-71082?

Yes. CVE-2025-71082 has been patched. Fixed versions include 5.15.198, 6.1.160, 6.6.120 and others. If you are running Linux kernel 3.7 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2025-71082 actively exploited?

No. CVE-2025-71082 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.