CVE-2025-68282 (GCVE-0-2025-68282)

Vulnerability from cvelistv5 – Published: 2025-12-16 15:06 – Updated: 2026-05-11 21:50
VLAI
Title
usb: gadget: udc: fix use-after-free in usb_gadget_state_work
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 , < dddc944d65169b552e09cb54e3ed4fbb9ea26416 (git)
Affected: 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 , < eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5 (git)
Affected: 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 , < c12a0c3ef815ddd67e47f9c819f9fe822fed5467 (git)
Affected: 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 , < f02a412c0a18f02f0f91b0a3d9788315a721b7fd (git)
Affected: 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 , < 10014310193cf6736c1aeb4105c5f4a0818d0c65 (git)
Affected: 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 , < 3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9 (git)
Affected: 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 , < baeb66fbd4201d1c4325074e78b1f557dff89b5b (git)
Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.119 , ≤ 6.6.* (semver)
Unaffected: 6.12.61 , ≤ 6.12.* (semver)
Unaffected: 6.17.11 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/core.c",
            "include/linux/usb/gadget.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dddc944d65169b552e09cb54e3ed4fbb9ea26416",
              "status": "affected",
              "version": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15",
              "versionType": "git"
            },
            {
              "lessThan": "eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5",
              "status": "affected",
              "version": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15",
              "versionType": "git"
            },
            {
              "lessThan": "c12a0c3ef815ddd67e47f9c819f9fe822fed5467",
              "status": "affected",
              "version": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15",
              "versionType": "git"
            },
            {
              "lessThan": "f02a412c0a18f02f0f91b0a3d9788315a721b7fd",
              "status": "affected",
              "version": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15",
              "versionType": "git"
            },
            {
              "lessThan": "10014310193cf6736c1aeb4105c5f4a0818d0c65",
              "status": "affected",
              "version": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15",
              "versionType": "git"
            },
            {
              "lessThan": "3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9",
              "status": "affected",
              "version": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15",
              "versionType": "git"
            },
            {
              "lessThan": "baeb66fbd4201d1c4325074e78b1f557dff89b5b",
              "status": "affected",
              "version": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/core.c",
            "include/linux/usb/gadget.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.119",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.61",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.11",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: fix use-after-free in usb_gadget_state_work\n\nA race condition during gadget teardown can lead to a use-after-free\nin usb_gadget_state_work(), as reported by KASAN:\n\n  BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0\n  Workqueue: events usb_gadget_state_work\n\nThe fundamental race occurs because a concurrent event (e.g., an\ninterrupt) can call usb_gadget_set_state() and schedule gadget-\u003ework\nat any time during the cleanup process in usb_del_gadget().\n\nCommit 399a45e5237c (\"usb: gadget: core: flush gadget workqueue after\ndevice removal\") attempted to fix this by moving flush_work() to after\ndevice_del(). However, this does not fully solve the race, as a new\nwork item can still be scheduled *after* flush_work() completes but\nbefore the gadget\u0027s memory is freed, leading to the same use-after-free.\n\nThis patch fixes the race condition robustly by introducing a \u0027teardown\u0027\nflag and a \u0027state_lock\u0027 spinlock to the usb_gadget struct. The flag is\nset during cleanup in usb_del_gadget() *before* calling flush_work() to\nprevent any new work from being scheduled once cleanup has commenced.\nThe scheduling site, usb_gadget_set_state(), now checks this flag under\nthe lock before queueing the work, thus safely closing the race window."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:50:08.718Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dddc944d65169b552e09cb54e3ed4fbb9ea26416"
        },
        {
          "url": "https://git.kernel.org/stable/c/eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c12a0c3ef815ddd67e47f9c819f9fe822fed5467"
        },
        {
          "url": "https://git.kernel.org/stable/c/f02a412c0a18f02f0f91b0a3d9788315a721b7fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/10014310193cf6736c1aeb4105c5f4a0818d0c65"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/baeb66fbd4201d1c4325074e78b1f557dff89b5b"
        }
      ],
      "title": "usb: gadget: udc: fix use-after-free in usb_gadget_state_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68282",
    "datePublished": "2025-12-16T15:06:04.332Z",
    "dateReserved": "2025-12-16T14:48:05.291Z",
    "dateUpdated": "2026-05-11T21:50:08.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68282",
      "date": "2026-05-26",
      "epss": "0.00076",
      "percentile": "0.22642"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68282\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T16:16:06.970\",\"lastModified\":\"2026-01-19T13:16:09.647\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: gadget: udc: fix use-after-free in usb_gadget_state_work\\n\\nA race condition during gadget teardown can lead to a use-after-free\\nin usb_gadget_state_work(), as reported by KASAN:\\n\\n  BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0\\n  Workqueue: events usb_gadget_state_work\\n\\nThe fundamental race occurs because a concurrent event (e.g., an\\ninterrupt) can call usb_gadget_set_state() and schedule gadget-\u003ework\\nat any time during the cleanup process in usb_del_gadget().\\n\\nCommit 399a45e5237c (\\\"usb: gadget: core: flush gadget workqueue after\\ndevice removal\\\") attempted to fix this by moving flush_work() to after\\ndevice_del(). However, this does not fully solve the race, as a new\\nwork item can still be scheduled *after* flush_work() completes but\\nbefore the gadget\u0027s memory is freed, leading to the same use-after-free.\\n\\nThis patch fixes the race condition robustly by introducing a \u0027teardown\u0027\\nflag and a \u0027state_lock\u0027 spinlock to the usb_gadget struct. The flag is\\nset during cleanup in usb_del_gadget() *before* calling flush_work() to\\nprevent any new work from being scheduled once cleanup has commenced.\\nThe scheduling site, usb_gadget_set_state(), now checks this flag under\\nthe lock before queueing the work, thus safely closing the race window.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/10014310193cf6736c1aeb4105c5f4a0818d0c65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/baeb66fbd4201d1c4325074e78b1f557dff89b5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c12a0c3ef815ddd67e47f9c819f9fe822fed5467\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dddc944d65169b552e09cb54e3ed4fbb9ea26416\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f02a412c0a18f02f0f91b0a3d9788315a721b7fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.