CVE-2025-68331
kernel: usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · December 22, 2025
Updated · June 30, 2026
Description
A use-after-free vulnerability was found in the USB Attached SCSI (UAS) driver in the Linux kernel. When a UAS device is unplugged during active data transfer, URBs may be unlinked after their associated scatterlist has been freed. The URB completion handler then accesses freed memory during DMA unmapping, causing kernel panic.
Statement
Physical removal of USB storage during I/O is the trigger. While this can happen accidentally, it can also be induced deliberately with physical access to the system.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-825 · Expired Pointer Dereference