{"id":"CVE-2025-71141","title":"drm/tilcdc: Fix removal actions in case of failed probe","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tilcdc: Fix removal actions in case of failed probe\n\nThe drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers\nshould only be called when the device h…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 69f03be1fa08a66735d53d92d3429c052540e3bf < 21e52dc7762908c3d499cfb493d1b8281fc1d3ab","Linux >= 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a < 28138ea7180c382b449ba9dce12fdec68880dea4","Linux >= 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a < 71be8825e83c90c1e020feb77b29e6a99629e642","Linux >= 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a < a585c7ef9cabda58088916baedc6573e9a5cd2a7","Linux 84021fa4cf190e257ae8b66d284cdb92e3fabe33","Linux >= 6.6.2 < 6.6.120","Linux >= 6.5.12 < 6.6","Linux 6.7"],"published":"2026-01-14","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:38:35.452Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71141","references":[{"url":"https://git.kernel.org/stable/c/21e52dc7762908c3d499cfb493d1b8281fc1d3ab"},{"url":"https://git.kernel.org/stable/c/28138ea7180c382b449ba9dce12fdec68880dea4"},{"url":"https://git.kernel.org/stable/c/71be8825e83c90c1e020feb77b29e6a99629e642"},{"url":"https://git.kernel.org/stable/c/a585c7ef9cabda58088916baedc6573e9a5cd2a7"}],"tags":["cve.org"],"epss":0.00178,"epssPercentile":0.07267,"ingestedAt":"2026-10-21T12:48:53.674Z","slug":"CVE-2025-71141","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tilcdc: Fix removal actions in case of failed probe\n\nThe drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers\nshould only be called when the device has been successfully registered.\nCurrently, these functions are called unconditionally in tilcdc_fini(),\nwhich causes warnings during probe deferral scenarios.\n\n[    7.972317] WARNING: CPU: 0 PID: 23 at drivers/gpu/drm/drm_atomic_state_helper.c:175 drm_atomic_helper_crtc_duplicate_state+0x60/0x68\n...\n[    8.005820]  drm_atomic_helper_crtc_duplicate_state from drm_atomic_get_crtc_state+0x68/0x108\n[    8.005858]  drm_atomic_get_crtc_state from drm_atomic_helper_disable_all+0x90/0x1c8\n[    8.005885]  drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x90/0x144\n[    8.005911]  drm_atomic_helper_shutdown from tilcdc_fini+0x68/0xf8 [tilcdc]\n[    8.005957]  tilcdc_fini [tilcdc] from tilcdc_pdev_probe+0xb0/0x6d4 [tilcdc]\n\nFix this by rewriting the failed probe cleanup path using the standard\ngoto error handling pattern, which ensures that cleanup functions are\nonly called on successfully initialized resources. Additionally, remove\nthe now-unnecessary is_registered flag.\n\n## Affected\n\n- `Linux >= 69f03be1fa08a66735d53d92d3429c052540e3bf < 21e52dc7762908c3d499cfb493d1b8281fc1d3ab`\n- `Linux >= 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a < 28138ea7180c382b449ba9dce12fdec68880dea4`\n- `Linux >= 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a < 71be8825e83c90c1e020feb77b29e6a99629e642`\n- `Linux >= 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a < a585c7ef9cabda58088916baedc6573e9a5cd2a7`\n- `Linux 84021fa4cf190e257ae8b66d284cdb92e3fabe33`\n- `Linux >= 6.6.2 < 6.6.120`\n- `Linux >= 6.5.12 < 6.6`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}