CVE-2025-71075: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71075 is a use-after-free vulnerability in the Linux kernel's aic94xx SCSI driver, specifically in the asd_pci_remove() function. The function fails to synchronize with pending tasklets before freeing the asd_ha structure, creating a race condition during device hot-unplug or module unload operations. It affects Linux kernel versions from 2.6.19.1 up to 5.10.248, 5.11–5.15.198, 5.16–6.1.160, 6.2–6.6.120, 6.7–6.12.64, and 6.13–6.18.3, as well as Microsoft's Azure Linux azl3_kernel_6.6.119.3-3. The vulnerability was published on January 13, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, kernel.org patches).

The root cause is classified as CWE-416 (Use After Free). In asd_pci_remove(), the driver frees the asd_ha structure without first calling tasklet_kill() to ensure all pending tasklets have completed. If a tasklet is scheduled and runs after the structure is freed, it accesses deallocated memory, resulting in a use-after-free condition. The attack vector is local (AV:L) with low privilege requirements (PR:L) and no user interaction needed, meaning a local attacker with standard user access can trigger the race condition by initiating a device hot-unplug or kernel module unload. The fix, applied upstream, adds tasklet_kill() calls before the asd_ha structure is freed to enforce proper synchronization (Feedly).

Successful exploitation can result in denial of service (kernel crash/panic), data corruption, or potential local privilege escalation, as the attacker can influence freed kernel memory. The vulnerability affects systems with aic94xx SAS (Serial Attached SCSI) host bus adapters, which are typically found in server environments. Confidentiality, integrity, and availability are all rated High in the CVSS assessment, reflecting the potential for full local system compromise (Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of this report (Feedly). No threat actor attribution has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists across multiple scanners including Nessus and Qualys.

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing use-after-free errors, general protection faults, or NULL pointer dereferences originating from the aic94xx or asd_pci_remove code path.
• Logs: Kernel oops or panic messages referencing asd_ha structure or tasklet-related functions in the aic94xx driver stack trace.
• Process/System: Unexpected system crashes or kernel panics coinciding with SCSI device hot-unplug events or modprobe -r aic94xx operations.
• File System: Presence of kernel crash dump files (e.g., /var/crash/) generated around the time of aic94xx device removal events.

Update to a patched Linux kernel version: 5.10.248+, 5.15.198+, 6.1.160+, 6.6.120+, 6.12.64+, or 6.18.3+ (or 6.19-rc1 and later). For Microsoft Azure Linux deployments, update beyond azl3_kernel_6.6.119.3-3. As a temporary workaround, avoid performing hot-unplug operations on aic94xx SCSI controllers and refrain from unloading the aic94xx kernel module until the patch is applied. Debian, Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Amazon Linux 2, and Oracle Linux have all issued updated kernel packages addressing this vulnerability (Feedly, Ubuntu Advisory, Debian LTS).