CVE-2025-39801 (GCVE-0-2025-39801)

Vulnerability from cvelistv5 – Published: 2025-09-15 12:36 – Updated: 2026-05-12 12:07
VLAI
Title
usb: dwc3: Remove WARN_ON for device endpoint command timeouts
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7063 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < dfe40159eec6ca63b40133bfa783eee2e3ed829f (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < 5a1a847d841505dba2bd85602daf5c218e1d85b8 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < 84c95dbf5bece56086cdb65a64162af35158bdd9 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < f49697dfba2915a9ff36f94604eb76fa61413929 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < db27482b9db340402e05d4e9b75352bbaca51af2 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < 45eae113dccaf8e502090ecf5b3d9e9b805add6f (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.149 , ≤ 6.1.* (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.44 , ≤ 6.12.* (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:31.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:10.119Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/ep0.c",
            "drivers/usb/dwc3/gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dfe40159eec6ca63b40133bfa783eee2e3ed829f",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "5a1a847d841505dba2bd85602daf5c218e1d85b8",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "84c95dbf5bece56086cdb65a64162af35158bdd9",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "f49697dfba2915a9ff36f94604eb76fa61413929",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "db27482b9db340402e05d4e9b75352bbaca51af2",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "45eae113dccaf8e502090ecf5b3d9e9b805add6f",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/ep0.c",
            "drivers/usb/dwc3/gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when \u0027panic_on_warn\u0027 is enabled\nand unnecessary call trace prints when \u0027panic_on_warn\u0027 is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n   =======\n-\u003edwc3_thread_interrupt\n -\u003edwc3_ep0_interrupt\n  -\u003econfigfs_composite_setup\n   -\u003ecomposite_setup\n    -\u003eusb_ep_queue\n     -\u003edwc3_gadget_ep0_queue\n      -\u003e__dwc3_gadget_ep0_queue\n       -\u003e__dwc3_ep0_do_control_data\n        -\u003edwc3_send_gadget_ep_cmd\n\n2. Disconnect\n   ==========\n-\u003edwc3_thread_interrupt\n -\u003edwc3_gadget_disconnect_interrupt\n  -\u003edwc3_ep0_reset_state\n   -\u003edwc3_ep0_end_control_data\n    -\u003edwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:36:32.006Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929"
        },
        {
          "url": "https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2"
        },
        {
          "url": "https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f"
        }
      ],
      "title": "usb: dwc3: Remove WARN_ON for device endpoint command timeouts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39801",
    "datePublished": "2025-09-15T12:36:43.936Z",
    "dateReserved": "2025-04-16T07:20:57.134Z",
    "dateUpdated": "2026-05-12T12:07:10.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39801",
      "date": "2026-10-27",
      "epss": "0.00153",
      "percentile": "0.04393"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-16T01:01:45.000Z",
      "cve": "CVE-2025-39801",
      "id": "msrc_CVE-2025-39801",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: dwc3: Remove WARN_ON for device endpoint command timeouts",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39801.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc3/ep0.c",
                  "drivers/usb/dwc3/gadget.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "dfe40159eec6ca63b40133bfa783eee2e3ed829f",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5a1a847d841505dba2bd85602daf5c218e1d85b8",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "84c95dbf5bece56086cdb65a64162af35158bdd9",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f49697dfba2915a9ff36f94604eb76fa61413929",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db27482b9db340402e05d4e9b75352bbaca51af2",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "45eae113dccaf8e502090ecf5b3d9e9b805add6f",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc3/ep0.c",
                  "drivers/usb/dwc3/gadget.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.2"
                  },
                  {
                    "lessThan": "3.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.190",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.149",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC CN 4100",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V5.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F47280F2-824C-4F32-9522-BEC57DD4A405",
                    "versionEndExcluding": "5.15.190",
                    "versionStartIncluding": "3.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8",
                    "versionEndExcluding": "6.1.149",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48",
                    "versionEndExcluding": "6.6.103",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "12351F24-1133-4775-960C-F2B47E81298B",
                    "versionEndExcluding": "6.12.44",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D",
                    "versionEndExcluding": "6.16.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when \u0027panic_on_warn\u0027 is enabled\nand unnecessary call trace prints when \u0027panic_on_warn\u0027 is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n   =======\n-\u003edwc3_thread_interrupt\n -\u003edwc3_ep0_interrupt\n  -\u003econfigfs_composite_setup\n   -\u003ecomposite_setup\n    -\u003eusb_ep_queue\n     -\u003edwc3_gadget_ep0_queue\n      -\u003e__dwc3_gadget_ep0_queue\n       -\u003e__dwc3_ep0_do_control_data\n        -\u003edwc3_send_gadget_ep_cmd\n\n2. Disconnect\n   ==========\n-\u003edwc3_thread_interrupt\n -\u003edwc3_gadget_disconnect_interrupt\n  -\u003edwc3_ep0_reset_state\n   -\u003edwc3_ep0_end_control_data\n    -\u003edwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: dwc3: Eliminar WARN_ON para los tiempos de espera de comandos de punto final de dispositivo\n\nEsta confirmaci\u00f3n aborda un tiempo de espera de comando de punto final raramente observado que causa p\u00e1nico del kernel debido a una advertencia cuando \u0027panic_on_warn\u0027 est\u00e1 habilitado y rastreos de llamadas innecesarios cuando \u0027panic_on_warn\u0027 est\u00e1 deshabilitado. Se observa durante casos de prueba de conexi\u00f3n/desconexi\u00f3n r\u00e1pidos controlados por software. El siguiente es uno de esos tiempos de espera de comandos de punto final que observamos:\n\n1. Conectar\n   =======\n-\u003edwc3_thread_interrupt\n -\u003edwc3_ep0_interrupt\n  -\u003econfigfs_composite_setup\n   -\u003ecomposite_setup\n    -\u003eusb_ep_queue\n     -\u003edwc3_gadget_ep0_queue\n      -\u003e__dwc3_gadget_ep0_queue\n       -\u003e__dwc3_ep0_do_control_data\n        -\u003edwc3_send_gadget_ep_cmd\n\n2. Desconectar\n   ==========\n-\u003edwc3_thread_interrupt\n -\u003edwc3_gadget_disconnect_interrupt\n  -\u003edwc3_ep0_reset_state\n   -\u003edwc3_ep0_end_control_data\n    -\u003edwc3_send_gadget_ep_cmd\n\nEn el escenario del problema, en plataformas Exynos, observamos que las transferencias de control para la conexi\u00f3n anterior a\u00fan no se han completado y el comando de finalizaci\u00f3n de transferencia enviado como parte de la secuencia de desconexi\u00f3n y el procesamiento de la solicitud de caracter\u00edstica USB_ENDPOINT_HALT del host agotan el tiempo de espera. Este podr\u00eda ser un escenario esperado ya que el controlador est\u00e1 procesando comandos de EP enviados como parte de la conexi\u00f3n anterior. Podr\u00eda ser mejor eliminar WARN_ON en todos los lugares donde se env\u00edan comandos de punto final de dispositivo para evitar p\u00e1nicos del kernel innecesarios debido a una advertencia."
          }
        ],
        "id": "CVE-2025-39801",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-15T13:15:35.580",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-617"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:33:49+00:00",
      "cve": "CVE-2025-39801",
      "id": "CVE-2025-39801",
      "initial_release_date": "2025-09-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: dwc3: Remove WARN_ON for device endpoint command timeouts",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39801.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-17T00:56:43Z",
      "cve": "CVE-2025-39801",
      "id": "CVE-2025-39801",
      "initial_release_date": "2025-09-24T23:22:47Z",
      "product_status:known_affected": "718",
      "product_status:known_not_affected": "65",
      "product_status:recommended": "495",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39801",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2025/cve-2025-39801.json",
      "version": "51"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.