Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-68282

usb: gadget: udc: fix use-after-free in usb_gadget_state_work

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < dddc944d65169b552e09cb54e3ed4fbb9ea26416affected
  • 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5affected
  • 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < c12a0c3ef815ddd67e47f9c819f9fe822fed5467affected
  • 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < f02a412c0a18f02f0f91b0a3d9788315a721b7fdaffected
  • 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < 10014310193cf6736c1aeb4105c5f4a0818d0c65affected
  • 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < 3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9affected
  • 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 to < baeb66fbd4201d1c4325074e78b1f557dff89b5baffected

Linux Linux

Default version status: affected

  • 3.12affected
  • 0 to < 3.12unaffected
  • 5.10.248 to ≤ 5.10.*unaffected
  • 5.15.198 to ≤ 5.15.*unaffected
  • 6.1.159 to ≤ 6.1.*unaffected
  • 6.6.119 to ≤ 6.6.*unaffected
  • 6.12.61 to ≤ 6.12.*unaffected
  • 6.17.11 to ≤ 6.17.*unaffected
  • 6.18 to ≤ *unaffected

References