Use-after-free in Linux kernel - CVE-2025-22023

Vulnerability identifier: #VU107681

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-22023

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the handle_tx_event() function in drivers/usb/host/xhci-ring.c. A local user can escalate privileges on the system.

Linux kernel
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Live Patching
Ubuntu
kernel-livepatch-6_4_0-150700_51-default-debuginfo
kernel-livepatch-6_4_0-150700_51-default
kernel-livepatch-SLE15-SP7_Update_0-debugsource
linux (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-azure (Ubuntu package)
linux-oem-6.11 (Ubuntu package)
linux-aws (Ubuntu package)

Install update from vendor's website.

Linux kernel - update to 6.14.1
kernel-livepatch-6_4_0-150700_51-default-debuginfo - update to 5-150700.3.12.2
kernel-livepatch-6_4_0-150700_51-default - update to 5-150700.3.12.2
kernel-livepatch-SLE15-SP7_Update_0-debugsource - update to 5-150700.3.12.2
linux (Ubuntu package) - addressed in versions 6.11.0-28.28, 6.11.0-28.28~24.04.1, 6.11.0-1011.11, 6.11.0-1014.14, 6.11.0-1015.16, 6.11.0-1016.16, 6.11.0-1016.16~24.04.1, 6.11.0-1017.18, 6.14.0-22.22, 6.14.0-1004.4, 6.14.0-1007.7, 6.14.0-1008.8
linux-lowlatency (Ubuntu package) - addressed in versions 6.11.0-1015.16, 6.11.0-1015.16~24.04.2
linux-azure (Ubuntu package) - addressed in versions 6.11.0-1018.18, 6.11.0-1018.18~24.04.1, 6.14.0-1007.7
linux-oem-6.11 (Ubuntu package) - update to 6.11.0-1024.24
linux-aws (Ubuntu package) - addressed in versions 6.14.0-1007.7, 6.14.0-1007.7+1

• https://git.kernel.org/stable/c/49cf6f5293aeb706dd672608478336a003f37df6
• https://git.kernel.org/stable/c/58d0a3fab5f4fdc112c16a4c6d382f62097afd1c
• https://git.kernel.org/stable/c/6af20ac254cbd0e1178a3542767c9308e209eee5
• https://git.kernel.org/stable/c/de9e78167f760a699806793d7c987239e4f6c8c3
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14.1

• Use-after-free in Linux kernel usb host driver
• Ubuntu update for linux
• Ubuntu update for linux-azure
• Ubuntu update for linux
• Ubuntu update for linux-oem-6.11
• Ubuntu update for linux-lowlatency
• Ubuntu update for linux-azure
• SUSE update for the Linux Kernel (Live Patch 0 for SLE 15 SP7)
• Ubuntu update for linux-aws