CVE-2025-68331: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68331 is a use-after-free / invalid memory access vulnerability in the Linux kernel's USB Attached SCSI (UAS) driver (drivers/usb/storage/uas.c). It occurs when a UAS device is unplugged during an active data transfer, potentially causing a system panic due to access of an already-freed scatter-gather (sg) structure with a zeroed dma_address field during URB callback handling. The vulnerability was published on December 22, 2025, and affects the Linux kernel across multiple stable branches, with downstream impact confirmed in distributions including Ubuntu and Amazon Linux 2. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Microsoft MSRC).

The root cause is a race condition and improper error handling in uas_submit_urbs() (CWE-416: Use After Free / CWE-362: Race Condition). When submitting three URBs sequentially — sense_urb, data_urb, and cmd_urb — device removal can occur mid-sequence, causing some URBs to fail with -ENODEV while others have already been successfully submitted. The flawed error path immediately calls scsi_done(), which triggers scsi_complete() → scsi_end_request() to free the scatter-gather table (sgtable). When the previously submitted URBs are subsequently unlinked and given back, usb_hcd_unmap_urb_for_dma() calls dma_direct_unmap_sg() on the already-freed sg structure whose dma_address is now 0, resulting in a kernel panic. The fix modifies error handling in uas_submit_urbs() to avoid premature invocation of scsi_done() and properly manage URB lifecycle during device removal (Red Hat CVE).

Successful exploitation causes a kernel panic (system crash), resulting in a denial of service for the affected host. An attacker with local access and the ability to physically remove a USB UAS storage device during active I/O can reliably trigger this condition. The CVSS assessment also notes high integrity impact, as the memory corruption could theoretically allow unauthorized access to kernel memory contents, though the primary observed impact is system instability and availability loss (Red Hat CVE).

1. Gain local access: Obtain physical or local user access to a Linux system with a USB UAS storage device attached and actively transferring data.
2. Initiate sustained data transfer: Start a large file copy or I/O-intensive operation to a UAS-class USB storage device (e.g., using dd or cp) to ensure URBs are continuously being submitted via uas_submit_urbs().
3. Abruptly remove the USB device: Physically unplug the UAS device mid-transfer, at the precise moment when uas_submit_urbs() is in the process of sequentially submitting sense_urb, data_urb, and cmd_urb.
4. Trigger the race condition: The removal causes some URBs to fail with -ENODEV while others are already submitted. The flawed error handler calls scsi_done(), freeing the scatter-gather table prematurely.
5. Kernel panic: When the successfully submitted URBs are unlinked and given back, usb_hcd_unmap_urb_for_dma() accesses the freed sg structure with dma_address == 0, causing a kernel panic and system crash.

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output referencing dma_direct_unmap_sg, usb_hcd_unmap_urb_for_dma, or uas.c with a null/zero DMA address; stack traces involving scsi_complete, scsi_end_request, or uas_submit_urbs.
• System Events: Unexpected system reboots or kernel oops events correlated with USB device removal events; dmesg entries showing usb X-X: USB disconnect immediately followed by kernel BUG or panic output.
• Process/Driver: Repeated -ENODEV errors from the uas kernel module in system logs during USB device removal; kernel crash dumps (if kdump is configured) with call traces through the UAS and USB HCD subsystems.

The Linux kernel upstream fix modifies error handling in uas_submit_urbs() to prevent premature scsi_done() invocation; patches are available in multiple stable kernel branches (commits 2b90a81, 26d56a9, 66ac05e, 75f8e26 on kernel.org). Downstream distributions have issued updates: Ubuntu has released USN-8094-1 through USN-8094-5, Amazon Linux 2 has issued ALAS2KERNEL-5.15-2025-096 and ALAS2KERNEL-5.10-2026-112, Oracle Linux has released ELSA-2026-50112 and ELSA-2026-50113, and Microsoft has patched the Azure Linux 3 kernel (version 6.6.117.1-1 and later) (Ubuntu USN-8094-1, Microsoft MSRC). As a workaround where patching is not immediately possible, avoid abruptly removing USB UAS devices during active data transfers, use OS-level safe-removal procedures, and restrict physical access to systems with sensitive USB storage devices.