CVE-2025-68331

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer

When a UAS device is unplugged during data transfer, there is

a probability of a system panic occurring. The root cause is

an access to an invalid memory address during URB callback handling.

Specifically, this happens when the dma_direct_unmap_sg() function

is called within the usb_hcd_unmap_urb_for_dma() interface, but the

sg->dma_address field is 0 and the sg data structure has already been

freed.

The SCSI driver sends transfer commands by invoking uas_queuecommand_lck()

in uas.c, using the uas_submit_urbs() function to submit requests to USB.

Within the uas_submit_urbs() implementation, three URBs (sense_urb,

data_urb, and cmd_urb) are sequentially submitted. Device removal may

occur at any point during uas_submit_urbs execution, which may result

in URB submission failure. However, some URBs might have been successfully

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References