CVE-2025-68316 Details
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix invalid probe error return value After DME Link Startup, the error return value is set to the MIPI UniPro GenericErrorCode which can be 0 (SUCCESS) or 1 (FAILURE). Upon failure during driver probe, the error code 1 is propagated back to the driver probe function which must return a negative value to indicate an error, but 1 is not negative, so the probe is considered to be successful even though it failed. Subsequently, removing the driver results in an oops because it is not in a valid state. This happens because none of the callers of ufshcd_init() expect a non-negative error code. Fix the return value and documentation to match actual usage.
A vulnerability in the Linux kernel's SCSI UFS driver has been addressed, concerning improper error handling during the driver probe process. After the DME Link Startup, the error return value can be either 0 (SUCCESS) or 1 (FAILURE). When the driver probe fails, the 'FAILURE' code is returned to the probe function, which expects a negative value to indicate an error. Since '1' is not negative, the probe is incorrectly deemed successful, leading to an invalid state. This issue causes a system error when the driver is removed, as the driver is not in a proper state. The vulnerability arises because the function 'ufshcd_init()' does not anticipate a non-negative error code, allowing the probe to be incorrectly reported as successful.
The vulnerability has been fixed in the Linux kernel. Users can upgrade to the latest version to address this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/a2b32bc1d9e359a9f90d0de6af16699facb10935 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/df96dbe1af7f6591c09f862f1226d3619b07e1b6 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 16, 2025 | New CVE Received | kernel.org |