Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: flush gadget workqueue after device removal device_del() can lead to new work being scheduled in gadget->work workqueue. This is observed, for example, with the dwc3 driver with the following call stack: device_del() gadget_unbind_driver() usb_gadget_disconnect_locked() dwc3_gadget_pullup() dwc3_gadget_soft_disconnect() usb_gadget_set_state() schedule_work(&gadget->work) Move flush_work() after device_del() to ensure the workqueue is cleaned up.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < e3bc1a9a67ce33a2e761e6e7b7c2afc6cb9b7266affected5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < 859cb45aefa6de823b2fa7f229fe6d9562c9f3b7affected5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < f894448f3904d7ad66fecef8f01fe0172629e091affected5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < 97695b5a1b5467a4f91194db12160f56da445dfeaffected5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < 399a45e5237ca14037120b1b895bd38a3b4492eaaffected
Linux Linux
Default version status: affected
3.12affected0 to < 3.12unaffected6.1.130 to ≤ 6.1.*unaffected6.6.80 to ≤ 6.6.*unaffected6.12.16 to ≤ 6.12.*unaffected6.13.4 to ≤ 6.13.*unaffected6.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e3bc1a9a67ce33a2e761e6e7b7c2afc6cb9b7266 ↗
- https://git.kernel.org/stable/c/859cb45aefa6de823b2fa7f229fe6d9562c9f3b7 ↗
- https://git.kernel.org/stable/c/f894448f3904d7ad66fecef8f01fe0172629e091 ↗
- https://git.kernel.org/stable/c/97695b5a1b5467a4f91194db12160f56da445dfe ↗
- https://git.kernel.org/stable/c/399a45e5237ca14037120b1b895bd38a3b4492ea ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗