CVE-2025-68288: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68288 is a kernel memory information disclosure vulnerability in the Linux kernel's USB bulk storage transport subsystem. When a USB storage device incorrectly skips the data phase and returns status data, the kernel extracts and validates the Command Status Wrapper (CSW) from the scatter-gather (sg) buffer but fails to zero it out afterwards, leaving USB protocol data (including the US_BULK_CS_SIGN 'USBS' signature, bytes 0x53425355) in the SCSI request block's (srb) transfer buffer. This residual data can then be read by unprivileged local users via SCSI generic (/dev/sg*) interfaces. The vulnerability was discovered through the ioctl_sg01 test from the Linux Test Project (LTP) and disclosed on December 16, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as an information exposure / missing data clearing issue (related to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). In the USB bulk-only transport protocol, when a non-conformant device skips the data phase and immediately returns a CSW, the kernel code path validates the CSW from the sg buffer but does not subsequently zero the buffer contents. This leaves the CSW — including the US_BULK_CS_SIGN magic value — in the srb's transfer buffer, which is later accessible to user space through the SCSI generic interface (/dev/sg*). The fix zeroes the CSW data in the srb's transfer buffer immediately after validation for devices that skip the data phase. This differs from CVE-2018-1000204, which addressed a similar leak by zeroing pages at allocation time; here the leak occurs post-allocation when USB protocol data is written to already-allocated sg pages (Red Hat CVE, EUVD).

The primary impact is information disclosure: a local user with low privileges can read kernel USB protocol data — including CSW status structures — through the /dev/sg* SCSI generic interface, potentially exposing sensitive kernel memory contents. The vulnerability has a high availability impact per the CVSS scoring, likely due to potential resource exhaustion from the memory leak condition. There is no direct impact on integrity or confidentiality of user data beyond the kernel protocol data exposure, and lateral movement potential is limited given the local access requirement (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires local access with low privileges and physical or logical access to a USB storage device that exhibits non-conformant behavior (skipping the data phase). The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Red Hat CVE).

Patches have been released for multiple Linux kernel stable branches. Administrators should update to the following patched versions or later: 5.10.247, 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18. Upstream kernel commits are available via the stable kernel git repository. Distribution-specific patches have been issued by Red Hat, Ubuntu (USN-8096-1/2/3/5, USN-8094-3/4/5, USN-8152-1), Debian (DLA-4436-1), Amazon Linux (ALAS2KERNEL-5.15-2025-096, ALAS2KERNEL-5.10-2026-112), Oracle Linux, and Microsoft Azure Linux. As a workaround, restricting unprivileged user access to /dev/sg* devices and enforcing strict USB device connection policies can reduce exposure (Red Hat CVE, Ubuntu USN-8096-1, Amazon Linux ALAS).