CVE-2025-68324

Vulnerability

CVE-2025-68324 is a use-after-free vulnerability in the Linux kernel's IMM (Iomega MatchMaker) parallel port SCSI host adapter driver. The root cause is a race condition between the detach path and the delayed work item imm_tq. The work item is initialized in imm_attach() and scheduled via imm_queuecommand() to process SCSI commands. When the adapter is detached through imm_detach(), the imm_struct device instance is deallocated with kfree(dev), but the delayed work may still be pending or executing, leading to access of freed memory in the work function imm_interrupt() [1][2][3][4].

Exploitation

An attacker with the ability to trigger SCSI commands on the IMM device and then cause the device to be detached can exploit this race. The attack requires local access to the system and the ability to load/unload the driver or hot-unplug the parallel port device. No special privileges beyond the ability to issue SCSI commands are needed, but the race window is narrow and may require repeated attempts.

Impact

Successful exploitation results in a use-after-free condition, which can lead to memory corruption, system crash (denial of service), or potentially arbitrary code execution in kernel context, depending on the state of the freed memory.

Mitigation

The fix adds a call to disable_delayed_work_sync() in imm_detach() to ensure the delayed work is cancelled before the device structure is freed. The patch has been applied to the Linux kernel stable branches as of versions 4.19, 5.4, 5.10, 5.15, and 6.1 [1][2][3][4]. Users should update to the latest patched kernel version.