CVE-2025-22020 Overview
CVE-2025-22020 is a use-after-free vulnerability [CWE-416] in the Linux kernel's rtsx_usb_ms memstick driver. The flaw resides in the rtsx_usb_ms_drv_remove function, where the driver frees the memstick host structure while a scheduled work item (rtsx_usb_ms_poll_card) can still access it. KASAN (Kernel Address Sanitizer) detected the resulting slab-use-after-free during device removal on kernel 6.14.0-rc6. The Linux kernel maintainers have released patches across multiple stable branches.
Critical Impact
A local authenticated attacker able to trigger USB device disconnect events can cause kernel memory corruption, leading to denial of service or potential local privilege escalation on affected Linux systems.
Affected Products
- Linux Kernel (multiple stable branches prior to the fix commits)
- Debian LTS distributions shipping the vulnerable rtsx_usb_ms module
- Systems with Realtek USB card readers exposing memstick functionality
Discovery Timeline
- 2025-04-16 - CVE-2025-22020 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22020
Vulnerability Analysis
The vulnerability is a slab-use-after-free condition in the Realtek USB memstick driver (drivers/memstick/host/rtsx_usb_ms.c). During driver removal, rtsx_usb_ms_drv_remove triggers device_release through kobject_cleanup, which calls kfree on the memstick host structure allocated by memstick_alloc_host. However, the polling workqueue routine rtsx_usb_ms_poll_card remains scheduled and dereferences the freed memory on a subsequent invocation.
The KASAN report identifies an 8-byte read at the freed slab address by a kworker thread executing rtsx_usb_ms_poll_card+0x159/0x200. Because the free path is triggered by USB disconnect handling (rtsx_usb_disconnect), the window between kfree and the next scheduled poll produces a deterministic memory-safety violation.
Root Cause
The root cause is a lifetime-management defect: the driver does not synchronously cancel or flush the polling work item before releasing the host structure. Because timers requeue the work through __queue_work after removal begins, the workqueue can operate on memory that has already been returned to the slab allocator.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker with permission to bind, unbind, or reset USB devices can force disconnect events against a Realtek USB card reader, racing the removal path against the polling workqueue. The vulnerable code path is reachable via usb_reset_device through usbdev_do_ioctl, meaning any process able to issue USB ioctls to the device node can trigger the condition.
The vulnerability manifests during device teardown. See the Kernel Commit Fixes and related upstream commits for the exact synchronization changes applied to rtsx_usb_ms_drv_remove.
Detection Methods for CVE-2025-22020
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in rtsx_usb_ms_poll_card in kernel logs (dmesg, /var/log/kern.log)
- Kernel oops or panic traces containing rtsx_usb_ms_drv_remove and kobject_cleanup on the freeing path
- Unexpected kworker crashes coinciding with USB device disconnect or reset events on Realtek card readers
Detection Strategies
- Audit installed kernel package versions against the fixed builds published by upstream and downstream distributions such as Debian.
- Monitor kernel ring buffer output for KASAN or general protection fault entries referencing the rtsx_usb_ms module.
- Correlate USB device reset ioctl activity with subsequent kernel error events on hosts using Realtek USB card readers.
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on rtsx_usb_ms, KASAN, or use-after-free string matches.
- Track process invocations issuing USBDEVFS_RESET ioctls against /dev/bus/usb/* device nodes on multi-user systems.
- Baseline expected USB peripheral behavior and flag anomalous rebind or disconnect volume that could indicate exploitation attempts.
How to Mitigate CVE-2025-22020
Immediate Actions Required
- Apply the upstream stable kernel updates that include the rtsx_usb_ms_drv_remove synchronization fix.
- On Debian LTS systems, install the kernel updates referenced in Debian LTS Announcement and Debian LTS Security Update.
- Restrict physical and logical access to USB device ioctls on shared or multi-tenant Linux hosts.
Patch Information
The Linux kernel maintainers merged fixes across multiple stable branches. Reference commits include 0067cb7d7e7c, 31f0eaed6914, 4676741a3464, 52d942a5302e, 6186fb2cd363, 75123adf204f, 914c5e5bfceb, 9dfaf4d723c6, and b094e8e3988e. See the Kernel Commit Patches entry for the canonical fix and the Kernel Commit Changes reference for backports.
Workarounds
- Blacklist the rtsx_usb_ms module on systems that do not require Memory Stick support via card reader hardware.
- Physically remove or disable Realtek USB card readers where the memstick functionality is not needed.
- Limit non-administrative user access to USB device files to reduce the attack surface for device reset ioctls.
# Blacklist the vulnerable module until patching is possible
echo "blacklist rtsx_usb_ms" | sudo tee /etc/modprobe.d/blacklist-rtsx-usb-ms.conf
sudo modprobe -r rtsx_usb_ms
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
