Use-After-Free Vulnerability in Linux Kernel Affecting SCSI Host Adapters

CVE-2025-68324

What is CVE-2025-68324?

A use-after-free vulnerability has been identified in the Linux kernel's SCSI subsystem, specifically affecting the IMM parallel port SCSI host adapter. This occurs when the delayed work item 'imm_tq', initialized in imm_attach() and scheduled through imm_queuecommand(), is still processing commands after the adapter has been detached via imm_detach(). When imm_detach() is called, it deallocates the imm_struct memory, but if a delayed work continues running, it may access this freed memory, causing potential memory corruption issues. To mitigate this, adding disable_delayed_work_sync() in imm_detach() will ensure that any pending delayed work is properly canceled before the memory is released.

References