Use-after-free in Linux kernel usb host driver

1) Use-after-free

EUVDB-ID: #VU107681

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22023

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the handle_tx_event() function in drivers/usb/host/xhci-ring.c. A local user can escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.14

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:6.14:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/49cf6f5293aeb706dd672608478336a003f37df6
https://git.kernel.org/stable/c/58d0a3fab5f4fdc112c16a4c6d382f62097afd1c
https://git.kernel.org/stable/c/6af20ac254cbd0e1178a3542767c9308e209eee5
https://git.kernel.org/stable/c/de9e78167f760a699806793d7c987239e4f6c8c3
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14.1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.