CVE-2025-37986

What it actually does

Use-after-free in the Linux kernel Type-C class when USB device pointers are not cleared on partner unregistration, allowing access to freed memory after disconnect.

Why it matters to the business

Potential kernel crashes, privilege escalation, or system compromise on affected Ubuntu Linux systems, increasing operational risk and requiring urgent patching on exposed endpoints.

How an attack unfolds

An attacker with local access triggers repeated Type-C partner connect/disconnect sequences to free USB device structures while other kernel code paths still reference them, leading to arbitrary read/write or code execution; observed in campaigns involving multiple related kernel privilege escalation flaws.

How to fix it

Upgrade linux-aws-5.15 on Ubuntu 20.04 LTS to version 5.15.0-1073.79~20.04.1 or later; apply the kernel update and reboot affected systems.

How to confirm the fix worked

Verify installed kernel version matches or exceeds the fixed release; test Type-C partner attach/detach cycles and monitor for pointer invalidation in kernel logs.

Typical attack path

1. Gain local access on affected Linux system
2. Manipulate Type-C USB partner registration/unregistration events
3. Trigger use of stale pointers to freed structures
4. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for USB Type-C unregistration events followed by invalid pointer dereferences; correlate with privilege escalation attempts from known campaigns.

What your security team should do

• Prioritize patching all linux-aws-5.15 instances to 5.15.0-1073.79~20.04.1 within 30 days
• Monitor for related privilege escalation activity from listed threat actors
• Restrict local unprivileged access where possible until patched