CVE-2025-68331

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer When a UAS device is unplugged during data transfer, there is a probability of a system panic occurring. The root cause is an access to an invalid memory address during URB callback handling. Specifically, this happens when the dma_direct_unmap_sg() function is called within the usb_hcd_unmap_urb_for_dma() interface, but the sg->dma_address field is 0 and the sg data structure has already been freed. The SCSI driver sends transfer commands by invoking uas_queuecommand_lck() in uas.c, using the uas_submit_urbs() function to submit requests to USB. Within the uas_submit_urbs() implementation, three URBs (sense_urb, data_urb, and cmd_urb) are sequentially submitted. Device removal may occur at any point during uas_submit_urbs execution, which may result in URB submission failure. However, some URBs might have been successfully submitted before the failure, and uas_submit_urbs will return the -ENODEV error code in this case. The current error handling directly calls scsi_done(). In the SCSI driver, this eventually triggers scsi_complete() to invoke scsi_end_request() for releasing the sgtable. The successfully submitted URBs, when being unlinked to giveback, call usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg unmapping operations since the sg data structure has already been freed. This patch modifies the error condition check in the uas_submit_urbs() function. When a UAS device is removed but one or more URBs have already been successfully submitted to USB, it avoids immediately invoking scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully submitted URBs is completed before devinfo->resetting being set, then the scsi_done() function will be called within uas_try_complete() after all pending URB operations are finalized. Otherwise, the scsi_done() function will be called within uas_zap_pending(), which is executed after usb_kill_anchored_urbs(). The error handling only takes effect when uas_queuecommand_lck() calls uas_submit_urbs() and returns the error value -ENODEV . In this case, the device is disconnected, and the flow proceeds to uas_disconnect(), where uas_zap_pending() is invoked to call uas_try_complete().

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2025-12-22 17:16:00.800000

Last modified

2026-10-19 21:10:00.160000

View original CVE JSON

{
  "id": "CVE-2025-68331",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-22T17:16:00.800",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer\n\nWhen a UAS device is unplugged during data transfer, there is\na probability of a system panic occurring. The root cause is\nan access to an invalid memory address during URB callback handling.\nSpecifically, this happens when the dma_direct_unmap_sg() function\nis called within the usb_hcd_unmap_urb_for_dma() interface, but the\nsg->dma_address field is 0 and the sg data structure has already been\nfreed.\n\nThe SCSI driver sends transfer commands by invoking uas_queuecommand_lck()\nin uas.c, using the uas_submit_urbs() function to submit requests to USB.\nWithin the uas_submit_urbs() implementation, three URBs (sense_urb,\ndata_urb, and cmd_urb) are sequentially submitted. Device removal may\noccur at any point during uas_submit_urbs execution, which may result\nin URB submission failure. However, some URBs might have been successfully\nsubmitted before the failure, and uas_submit_urbs will return the -ENODEV\nerror code in this case. The current error handling directly calls\nscsi_done(). In the SCSI driver, this eventually triggers scsi_complete()\nto invoke scsi_end_request() for releasing the sgtable. The successfully\nsubmitted URBs, when being unlinked to giveback, call\nusb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg\nunmapping operations since the sg data structure has already been freed.\n\nThis patch modifies the error condition check in the uas_submit_urbs()\nfunction. When a UAS device is removed but one or more URBs have already\nbeen successfully submitted to USB, it avoids immediately invoking\nscsi_done() and save the cmnd to devinfo->cmnd array. If the successfully\nsubmitted URBs is completed before devinfo->resetting being set, then\nthe scsi_done() function will be called within uas_try_complete() after\nall pending URB operations are finalized. Otherwise, the scsi_done()\nfunction will be called within uas_zap_pending(), which is executed after\nusb_kill_anchored_urbs().\n\nThe error handling only takes effect when uas_queuecommand_lck() calls\nuas_submit_urbs() and returns the error value -ENODEV . In this case,\nthe device is disconnected, and the flow proceeds to uas_disconnect(),\nwhere uas_zap_pending() is invoked to call uas_try_complete()."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\\n\\nusb: uas: corregir problema de desasignación de URB cuando el dispositivo uas se elimina durante una transferencia de datos en curso\\n\\nCuando un dispositivo UAS se desconecta durante una transferencia de datos, existe una probabilidad de que se produzca un pánico del sistema. La causa raíz es un acceso a una dirección de memoria no válida durante el manejo de la devolución de llamada del URB. Específicamente, esto ocurre cuando la función dma_direct_unmap_sg() se llama dentro de la interfaz usb_hcd_unmap_urb_for_dma(), pero el campo sg -> dma_address es 0 y la estructura de datos sg ya ha sido liberada.\\n\\nEl controlador SCSI envía comandos de transferencia invocando uas_queuecommand_lck() en uas.c, utilizando la función uas_submit_urbs() para enviar solicitudes al USB. Dentro de la implementación de uas_submit_urbs(), se envían secuencialmente tres URB (sense_urb, data_urb y cmd_urb). La extracción del dispositivo puede ocurrir en cualquier punto durante la ejecución de uas_submit_urbs, lo que puede resultar en una falla al enviar el URB. Sin embargo, algunos URB podrían haberse enviado con éxito antes de la falla, y uas_submit_urbs devolverá el código de error -ENODEV en este caso. El manejo de errores actual llama directamente a scsi_done().\\n\\nEn el controlador SCSI, esto finalmente desencadena scsi_complete() para invocar scsi_end_request() y liberar la sgtable. Los URB enviados con éxito, al ser desvinculados para su devolución, llaman a usb_hcd_unmap_urb_for_dma() en hcd.c, lo que genera excepciones durante las operaciones de desasignación de sg, ya que la estructura de datos sg ya ha sido liberada.\\n\\nEste parche modifica la verificación de la condición de error en la función uas_submit_urbs(). Cuando se elimina un dispositivo UAS pero uno o más URB ya han sido enviados con éxito al USB, evita invocar inmediatamente scsi_done() y guarda el cmnd en la matriz devinfo -> cmnd. Si los URB enviados con éxito se completan antes de que se establezca devinfo -> resetting, entonces la función scsi_done() se llamará dentro de uas_try_complete() después de que se finalicen todas las operaciones de URB pendientes. De lo contrario, la función scsi_done() se llamará dentro de uas_zap_pending(), que se ejecuta después de usb_kill_anchored_urbs().\\n\\nEl manejo de errores solo tiene efecto cuando uas_queuecommand_lck() llama a uas_submit_urbs() y devuelve el valor de error -ENODEV. En este caso, el dispositivo está desconectado y el flujo continúa a uas_disconnect(), donde se invoca uas_zap_pending() para llamar a uas_try_complete()."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/usb/storage/uas.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "eb2a86ae8c544be0ab04aa8169390c0669bc7148",
              "lessThan": "6289fc489e94c9beb6be2b502ccc263663733d72",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "eb2a86ae8c544be0ab04aa8169390c0669bc7148",
              "lessThan": "66ac05e7b0d6bbd1bee9fcf729e20fd4cce86d17",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "eb2a86ae8c544be0ab04aa8169390c0669bc7148",
              "lessThan": "75f8e2643085db4f7e136fc6b368eb114dd80a64",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "eb2a86ae8c544be0ab04aa8169390c0669bc7148",
              "lessThan": "e3a55221f4de080cb7a91ba10f01c4f708603f8d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "eb2a86ae8c544be0ab04aa8169390c0669bc7148",
              "lessThan": "2b90a8131c83f6f2be69397d2b7d14d217d95d2f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "eb2a86ae8c544be0ab04aa8169390c0669bc7148",
              "lessThan": "426edbfc88b22601ea34a441a469092e7b301c52",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "eb2a86ae8c544be0ab04aa8169390c0669bc7148",
              "lessThan": "26d56a9fcb2014b99e654127960aa0a48a391e3c",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/usb/storage/uas.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.10",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.10",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.247",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.197",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.159",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.119",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.61",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.11",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/26d56a9fcb2014b99e654127960aa0a48a391e3c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2b90a8131c83f6f2be69397d2b7d14d217d95d2f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/426edbfc88b22601ea34a441a469092e7b301c52",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6289fc489e94c9beb6be2b502ccc263663733d72",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/66ac05e7b0d6bbd1bee9fcf729e20fd4cce86d17",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/75f8e2643085db4f7e136fc6b368eb114dd80a64",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e3a55221f4de080cb7a91ba10f01c4f708603f8d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}