CVE-2025-22020 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2025-22020?

CVE-2025-22020 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's rtsx_usb_ms driver for Realtek memory card readers. It allows attackers with local access to cause kernel crashes or potentially execute arbitrary code. Systems using affected Realtek USB memory card reader hardware with vulnerable kernel versions are affected.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's rtsx_usb_ms driver for Realtek memory card readers. It allows attackers with local access to cause kernel crashes or potentially execute arbitrary code. Systems using affected Realtek USB memory card reader hardware with vulnerable kernel versions are affected.

💻 Affected Systems

Products:

Linux kernel with rtsx_usb_ms driver

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Realtek USB memory card reader hardware where the rtsx_usb_ms driver is loaded. The driver is typically auto-loaded when hardware is detected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel mode, allowing complete system compromise and arbitrary code execution with kernel privileges.

🟠

Likely Case

Kernel panic leading to system crash and denial of service, requiring physical or remote console access to reboot.

🟢

If Mitigated

System crash requiring reboot, but no privilege escalation due to additional security controls like KASAN or SMEP/SMAP.

🌐 Internet-Facing: LOW - Requires local access to the system, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local attackers or malicious users could exploit this to crash systems or potentially gain elevated privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger driver removal while polling work is scheduled. Exploit would need to race between workqueue execution and driver cleanup.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing fix commits: 0067cb7d7e7c277e91a0887a3c24e71462379469, 31f0eaed6914333f42501fc7e0f6830879f5ef2d, 4676741a3464b300b486e70585c3c9b692be1632, 52d942a5302eefb3b7a3bfee310a5a33feeedc21, 6186fb2cd36317277a8423687982140a7f3f7841

Vendor Advisory: https://git.kernel.org/stable/c/0067cb7d7e7c277e91a0887a3c24e71462379469

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Blacklist rtsx_usb_ms driver

linux

Prevent loading of vulnerable driver module

echo 'blacklist rtsx_usb_ms' >> /etc/modprobe.d/blacklist-rtsx.conf
update-initramfs -u
reboot

Remove Realtek hardware

all

Physically remove or disable Realtek USB memory card reader hardware

🧯 If You Can't Patch

Disable or remove Realtek USB memory card reader hardware
Implement strict access controls to prevent local users from accessing systems with vulnerable hardware

🔍 How to Verify

Check if Vulnerable:

Check if rtsx_usb_ms module is loaded: lsmod | grep rtsx_usb_ms. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Check dmesg for absence of KASAN slab-use-after-free errors related to rtsx_usb_ms.

📡 Detection & Monitoring

Log Indicators:

KASAN slab-use-after-free errors in kernel logs
Kernel oops/panic messages mentioning rtsx_usb_ms
Workqueue errors in system logs

SIEM Query:

source="kernel" AND ("KASAN: slab-use-after-free" OR "rtsx_usb_ms" OR "BUG:")

📊 Metadata

CVE ID: CVE-2025-22020

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.06% exploit probability (18.1th percentile)

Published: April 16, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-22020, you might also want to check these: