CVE-2025-68323: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68323 is a use-after-free vulnerability in the Linux kernel's USB Type-C (UCSI) subsystem, specifically in the gaokun_ucsi driver. The flaw arises because the delayed work item uec->work, scheduled during gaokun_ucsi_probe(), is never properly canceled in gaokun_ucsi_remove(), allowing freed memory structures to be accessed. It was disclosed on December 18, 2025, and affects the Linux kernel across multiple distributions including Red Hat, SUSE, Debian, and Ubuntu. The CVSS category is estimated as Medium, with an EPSS score of 0.017% (Red Hat CVE, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416) in the gaokun_ucsi driver within the Linux kernel's usb/typec/ucsi subsystem. When a USB Type-C device is removed, gaokun_ucsi_remove() calls ucsi_destroy() and frees the gaokun_ucsi and ucsi structures, but fails to cancel the pending delayed work uec->work (the gaokun_ucsi_register_worker()). This creates a race window of approximately 3 seconds during which the work item may still be executing or queued, and subsequently accesses the already-freed memory. The bug was confirmed via KASAN, which reported a slab-use-after-free write of 8 bytes in __run_timers triggered from the timer softirq path (Red Hat Bugzilla).

Successful exploitation of this vulnerability can lead to kernel crashes (kernel panic), system instability, or potentially arbitrary code execution in kernel context. Because the vulnerability operates at the kernel level, a successful exploit could compromise the entire system, bypassing user-space isolation boundaries. The 3-second race window makes the bug reliably reproducible, increasing the practical risk on affected systems with USB Type-C hardware managed by the gaokun_ucsi driver (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a low probability of near-term exploitation. Exploitation would require local access to a system with an affected USB Type-C device and the ability to trigger device probe/removal cycles (Red Hat CVE).

The fix is available upstream in the Linux kernel via patches committed to the stable tree (commits 2b7a0f47aaf2, a880ef71a1c8, d8ac85c76a42). Distribution-level patches have been released by Ubuntu (USN-8094-1 through USN-8094-5, USN-8152-1), SUSE, Debian (linux 6.1.713-1), and tracked by Red Hat. Users should update to the latest patched kernel version provided by their distribution. As a temporary workaround on unpatched systems, avoiding hot-plug/removal of USB Type-C devices managed by the gaokun_ucsi driver can reduce exposure (Ubuntu USN-8094-1, Red Hat Bugzilla, Debian Tracker).

The vulnerability received routine coverage across Linux security aggregators and distribution security teams. Ubuntu issued five successive security notices (USN-8094-1 through USN-8094-5 and USN-8152-1) addressing the flaw across multiple kernel variants. SUSE and Debian also issued advisories. Social media activity was limited to automated CVE tracking accounts on Bluesky and Mastodon/VulDB. No notable independent researcher commentary or significant media coverage was identified (Ubuntu USN-8094-1, Ubuntu USN-8152-1).