{"id":"CVE-2025-68781","state":"PUBLISHED","title":"usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: phy: fsl-usb: Fix use-after-free in delayed work during device removal\n\nThe delayed work item otg_event is initialized in fsl_otg_conf() and\nscheduled under two conditions:\n1. When a host controller binds to the OTG controller.\n2. When the USB ID pin state changes (cable insertion/removal).\n\nA race condition occurs when the device is removed via fsl_otg_remove():\nthe fsl_otg instance may be freed while the delayed work is still pending\nor executing. This leads to use-after-free when the work function\nfsl_otg_event() accesses the already freed memory.\n\nThe problematic scenario:\n\n(detach thread)            | (delayed work)\nfsl_otg_remove()           |\n  kfree(fsl_otg_dev) //FREE| fsl_otg_event()\n                           |   og = container_of(...) //USE\n                           |   og-> //USE\n\nFix this by calling disable_delayed_work_sync() in fsl_otg_remove()\nbefore deallocating the fsl_otg structure. This ensures the delayed work\nis properly canceled and completes execution prior to memory deallocation.\n\nThis bug was identified through static analysis.","publishedAt":"2026-01-13T15:28:56.261Z","updatedAt":"2026-09-02T12:49:30.176Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0807c500a1a6d7fa20cbd7bbe7fea14a66112463","status":"affected","lessThan":"69f9a0701abc3d1f8225074c56c27e6c16a37222","versionType":"git"},{"version":"0807c500a1a6d7fa20cbd7bbe7fea14a66112463","status":"affected","lessThan":"2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23","versionType":"git"},{"version":"0807c500a1a6d7fa20cbd7bbe7fea14a66112463","status":"affected","lessThan":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/phy/phy-fsl-usb.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.0","versionType":"semver"},{"version":"6.12.64","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.3","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/phy/phy-fsl-usb.c"]}],"references":["https://git.kernel.org/stable/c/69f9a0701abc3d1f8225074c56c27e6c16a37222","https://git.kernel.org/stable/c/2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23","https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/68xxx/CVE-2025-68781.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68781","state":"PUBLISHED","datePublished":"2026-01-13T15:28:56.261Z","dateUpdated":"2026-09-02T12:49:30.176Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-24T10:30:51.036Z"},"containers":{"cna":{"title":"usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: phy: fsl-usb: Fix use-after-free in delayed work during device removal\n\nThe delayed work item otg_event is initialized in fsl_otg_conf() and\nscheduled under two conditions:\n1. When a host controller binds to the OTG controller.\n2. When the USB ID pin state changes (cable insertion/removal).\n\nA race condition occurs when the device is removed via fsl_otg_remove():\nthe fsl_otg instance may be freed while the delayed work is still pending\nor executing. This leads to use-after-free when the work function\nfsl_otg_event() accesses the already freed memory.\n\nThe problematic scenario:\n\n(detach thread)            | (delayed work)\nfsl_otg_remove()           |\n  kfree(fsl_otg_dev) //FREE| fsl_otg_event()\n                           |   og = container_of(...) //USE\n                           |   og-> //USE\n\nFix this by calling disable_delayed_work_sync() in fsl_otg_remove()\nbefore deallocating the fsl_otg structure. This ensures the delayed work\nis properly canceled and completes execution prior to memory deallocation.\n\nThis bug was identified through static analysis."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0807c500a1a6d7fa20cbd7bbe7fea14a66112463","status":"affected","lessThan":"69f9a0701abc3d1f8225074c56c27e6c16a37222","versionType":"git"},{"version":"0807c500a1a6d7fa20cbd7bbe7fea14a66112463","status":"affected","lessThan":"2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23","versionType":"git"},{"version":"0807c500a1a6d7fa20cbd7bbe7fea14a66112463","status":"affected","lessThan":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/phy/phy-fsl-usb.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.0","versionType":"semver"},{"version":"6.12.64","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.3","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/phy/phy-fsl-usb.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/69f9a0701abc3d1f8225074c56c27e6c16a37222"},{"url":"https://git.kernel.org/stable/c/2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23"},{"url":"https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-09-02T12:49:30.176Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.12.64"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.18.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.19"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}