Read the docs
TI-2025-15970 Aliases CVE-2025-22020GHSA-h2g5-mxp5-qrcx

memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove

Priority LOW 35CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 29 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_one_work+0x357/0x660 worker_thread+0x390/0x4c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x190/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 161446: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x1a7/0x470 memstick_alloc_host+0x1f/0xe0 [memstick] rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] platform_probe+0x60/0xe0 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 bus_probe_device+0xbd/0xd0 device_add+0x4a5/0x760 platform_device_add+0x189/0x370 mfd_add_device+0x587/0x5e0 mfd_add_devices+0xb1/0x130 rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] usb_probe_interface+0x15c/0x460 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 rebind_marked_interfaces.isra.0+0xcc/0x110 usb_reset_device+0x352/0x410 usbdev_do_ioctl+0xe5c/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 161506: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0x34/0x50 kfree+0x1fd/0x3b0 device_release+0x56/0xf0 kobject_cleanup+0x73/0x1c0 rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] platform_remove+0x2f/0x50 device_release_driver_internal+0x24b/0x2e0 bus_remove_device+0x124/0x1d0 device_del+0x239/0x530 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x40 mfd_remove_devices_fn+0x167/0x170 device_for_each_child_reverse+0xc9/0x130 mfd_remove_devices+0x6e/0xa0 rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] usb_unbind_interface+0xf3/0x3f0 device_release_driver_internal+0x24b/0x2e0 proc_disconnect_claim+0x13d/0x220 usbdev_do_ioctl+0xb5e/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x ---truncated---

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.4.292, 5.10.236, 5.15.180 +6Red Hat: 10 advisoriesRed Hat: 29 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.0 and later5.4.292, 5.10.236, 5.15.180, 6.1.133, 6.6.86, 6.12.22, 6.13.10, 6.14.1, 6.15Patch availableCNA
  • Linux VendorLinux Affected 5.0 and later Fixed in 5.4.292, 5.10.236, 5.15.180, 6.1.133, 6.6.86, 6.12.22, 6.13.10, 6.14.1, 6.15 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*5.0 to before 5.4.292; 5.5 to before 5.10.236; 5.11 to before 5.15.180; 5.16 to before 6.1.133; 6.2 to before 6.6.86; 6.7 to before 6.12.22; 6.13 to before 6.13.10; 6.14 to before 6.14.1VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.0 to before 5.4.292; 5.5 to before 5.10.236; 5.11 to before 5.15.180; 5.16 to before 6.1.133; 6.2 to before 6.6.86; 6.7 to before 6.12.22; 6.13 to before 6.13.10; 6.14 to before 6.14.1 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.4.292, 5.10.236, 5.15.180, 6.1.133, 6.6.86, 6.12.22, 6.13.10, 6.14.1, 6.15

Red Hat 10 advisories

  • RHSA-2025:14418 Released 2025-08-25 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) bpftool-4.18.0-477.106.1.el8_8, kernel-4.18.0-477.106.1.el8_8, kernel-abi-stablelists-4.18.0-477.106.1.el8_8 +14
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) bpftool-4.18.0-477.106.1.el8_8, kernel-4.18.0-477.106.1.el8_8, kernel-abi-stablelists-4.18.0-477.106.1.el8_8 +14
  • RHSA-2025:14094 Released 2025-08-19 · Red Hat rating Moderate
    kernel-rt security update
    • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt-5.14.0-70.142.1.rt21.214.el9_0, kernel-rt-core-5.14.0-70.142.1.rt21.214.el9_0, kernel-rt-debug-5.14.0-70.142.1.rt21.214.el9_0 +9
    • Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt-5.14.0-70.142.1.rt21.214.el9_0, kernel-rt-core-5.14.0-70.142.1.rt21.214.el9_0, kernel-rt-debug-5.14.0-70.142.1.rt21.214.el9_0 +7
  • RHSA-2025:14054 Released 2025-08-19 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) kernel-debug-devel-5.14.0-70.142.1.el9_0, kernel-debug-devel-matched-5.14.0-70.142.1.el9_0, kernel-devel-5.14.0-70.142.1.el9_0 +5
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) bpftool-5.14.0-70.142.1.el9_0, kernel-5.14.0-70.142.1.el9_0, kernel-abi-stablelists-5.14.0-70.142.1.el9_0 +14
Show 7 more Red Hat advisories
  • RHSA-2025:13946 Released 2025-08-18 · Red Hat rating Moderate
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) kernel-tools-libs-devel-5.14.0-427.83.1.el9_4, libperf-5.14.0-427.83.1.el9_4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) kernel-64k-debug-devel-5.14.0-427.83.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.83.1.el9_4, kernel-64k-devel-5.14.0-427.83.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool-7.3.0-427.83.1.el9_4, kernel-5.14.0-427.83.1.el9_4, kernel-64k-5.14.0-427.83.1.el9_4 +29
    • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt-5.14.0-427.83.1.el9_4, kernel-rt-core-5.14.0-427.83.1.el9_4, kernel-rt-debug-5.14.0-427.83.1.el9_4 +9
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt-5.14.0-427.83.1.el9_4, kernel-rt-core-5.14.0-427.83.1.el9_4, kernel-rt-debug-5.14.0-427.83.1.el9_4 +11
  • RHSA-2025:13781 Released 2025-08-13 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-64k-debug-devel-5.14.0-284.130.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.130.1.el9_2, kernel-64k-devel-5.14.0-284.130.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool-7.0.0-284.130.1.el9_2, kernel-5.14.0-284.130.1.el9_2, kernel-64k-5.14.0-284.130.1.el9_2 +29
  • RHSA-2025:13633 Released 2025-08-11 · Red Hat rating Moderate
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt-5.14.0-284.130.1.rt14.415.el9_2, kernel-rt-core-5.14.0-284.130.1.rt14.415.el9_2, kernel-rt-debug-5.14.0-284.130.1.rt14.415.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt-5.14.0-284.130.1.rt14.415.el9_2, kernel-rt-core-5.14.0-284.130.1.rt14.415.el9_2, kernel-rt-debug-5.14.0-284.130.1.rt14.415.el9_2 +11
  • RHSA-2025:12752 Released 2025-08-04 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.66.1.el8_10, kernel-4.18.0-553.66.1.el8_10, kernel-abi-stablelists-4.18.0-553.66.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.66.1.el8_10
  • RHSA-2025:12746 Released 2025-08-04 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-570.32.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.32.1.el9_6, kernel-64k-devel-5.14.0-570.32.1.el9_6 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-570.32.1.el9_6, kernel-64k-5.14.0-570.32.1.el9_6, kernel-64k-core-5.14.0-570.32.1.el9_6 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-570.32.1.el9_6, libperf-5.14.0-570.32.1.el9_6
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-570.32.1.el9_6, kernel-rt-64k-5.14.0-570.32.1.el9_6, kernel-rt-64k-core-5.14.0-570.32.1.el9_6 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-570.32.1.el9_6, kernel-rt-core-5.14.0-570.32.1.el9_6, kernel-rt-debug-5.14.0-570.32.1.el9_6 +11
  • RHSA-2025:12753 Released 2025-08-04 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.66.1.rt7.407.el8_10, kernel-rt-core-4.18.0-553.66.1.rt7.407.el8_10, kernel-rt-debug-4.18.0-553.66.1.rt7.407.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.66.1.rt7.407.el8_10, kernel-rt-core-4.18.0-553.66.1.rt7.407.el8_10, kernel-rt-debug-4.18.0-553.66.1.rt7.407.el8_10 +7
  • RHSA-2025:12662 Released 2025-08-04 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-55.25.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.25.1.el10_0, kernel-64k-devel-6.12.0-55.25.1.el10_0 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-55.25.1.el10_0, kernel-64k-6.12.0-55.25.1.el10_0, kernel-64k-core-6.12.0-55.25.1.el10_0 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-55.25.1.el10_0, libperf-6.12.0-55.25.1.el10_0
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-55.25.1.el10_0, kernel-rt-64k-6.12.0-55.25.1.el10_0, kernel-rt-64k-core-6.12.0-55.25.1.el10_0 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-55.25.1.el10_0, kernel-rt-core-6.12.0-55.25.1.el10_0, kernel-rt-debug-6.12.0-55.25.1.el10_0 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:13946
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:12662
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:12746
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:14054
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:13781
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:13946
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:12662
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:12752
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:12746
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2025:14418
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:14054
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:13781
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:13946
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2025:14418
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:12752
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:12662
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:12746
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2025:12753
Red Hat Enterprise Linux NFV E4S (v.9.0)Fixed RHSA-2025:14094
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2025:12753
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2025:12662
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2025:12746
Red Hat Enterprise Linux Real Time E4S (v.9.0)Fixed RHSA-2025:14094
Red Hat Enterprise Linux Real Time E4S (v.9.2)Fixed RHSA-2025:13633
Red Hat Enterprise Linux Real Time EUS (v.9.4)Fixed RHSA-2025:13946
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2025:12662
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2025:12746
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)Fixed RHSA-2025:13633
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)Fixed RHSA-2025:13946
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22020
  2. 2026-10-03 Alias added: GHSA-h2g5-mxp5-qrcx

References

Patch 9

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences