CVE-2025-68324: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68324 is a use-after-free vulnerability in the Linux kernel's scsi: imm driver (IMM parallel port SCSI host adapter) caused by a race condition between device detachment and unfinished delayed work. The flaw affects Linux kernel versions from 2.6.12 onward, with patches applied in stable releases 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. It was published on December 18, 2025, by kernel.org. The CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector with low privileges required and high availability impact (Red Hat CVE, Feedly).

The root cause is a use-after-free (CWE-416) race condition in the Linux kernel's drivers/scsi/imm.c. The delayed work item imm_tq is initialized in imm_attach() and scheduled via imm_queuecommand_lck() to process SCSI commands. When imm_detach() is called concurrently, it frees the imm_struct device instance via kfree(dev) without first ensuring the delayed work has completed. If imm_interrupt() executes on another CPU after the free, it accesses the deallocated imm_struct memory through container_of(), resulting in a use-after-free. The fix adds a call to disable_delayed_work_sync() in imm_detach() to synchronously cancel the pending work before deallocation (Red Hat CVE, kernel.org patches).

Successful exploitation of this vulnerability can cause a kernel crash or system hang, resulting in a denial of service (high availability impact). Because the vulnerability is local and requires low privileges, an attacker with access to a system using the IMM parallel port SCSI driver could trigger the race condition by repeatedly attaching and detaching the device while queuing SCSI commands. There is no direct confidentiality or integrity impact identified (Red Hat CVE, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68324. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the presence of the IMM parallel port SCSI driver, which is uncommon in modern environments, further limiting practical exploitability (Feedly, Red Hat CVE).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable versions: 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Downstream distributions including Ubuntu (USN-8094-1 through USN-8094-5, USN-8152-1), SUSE, Oracle Linux (ELSA-2026-50112), and Debian (linux 6.17.13-1) have also issued updated kernel packages. Administrators should update to a patched kernel version as soon as possible. On systems where the IMM parallel port SCSI driver is not needed, blacklisting the imm kernel module (echo 'blacklist imm' >> /etc/modprobe.d/blacklist.conf) can serve as a workaround (Ubuntu USN-8094-1, Red Hat CVE, Debian Tracker).