cbcvebase.
CVE-2025-68287
published 2025-12-16

CVE-2025-68287: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This…

PriorityP424high7.8
EPSS
0.21%
10.8th percentile
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dwc3_remove_requests()`, leading to premature freeing of USB requests and subsequent crashes. Three distinct execution paths interact with `dwc3_remove_requests()`: Path 1: Triggered via `dwc3_gadget_reset_interrupt()` during USB reset handling. The call stack includes: - `dwc3_ep0_reset_state()` - `dwc3_ep0_stall_and_restart()` - `dwc3_ep0_out_start()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 2: Also initiated from `dwc3_gadget_reset_interrupt()`, but through `dwc3_stop_active_transfers()`. The call stack includes: - `dwc3_stop_active_transfers()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 3: Occurs independently during `adb root` execution, which triggers USB function unbind and bind operations. The sequence includes: - `gserial_disconnect()` - `usb_ep_disable()` - `dwc3_gadget_ep_disable()` - `dwc3_remove_requests()` with `-ESHUTDOWN` status Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions. To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.159-1 (bookworm)linux 6.1.159-1 (bookworm)
debianlinux-6.1< linux 6.1.159-1 (bookworm)linux 6.1.159-1 (bookworm)
linuxlinux
linuxlinux>= 72246da40f3719af3bfd104a2365b32537c27d83 < 467add9db13219101f14b6cc5477998b4aaa5fe2467add9db13219101f14b6cc5477998b4aaa5fe2
linuxlinux>= 72246da40f3719af3bfd104a2365b32537c27d83 < 67192e8cb7f941b5bba91e4bb290683576ce160767192e8cb7f941b5bba91e4bb290683576ce1607
linuxlinux>= 72246da40f3719af3bfd104a2365b32537c27d83 < 47de14d741cc4057046c9e2f33df1f7828254e6c47de14d741cc4057046c9e2f33df1f7828254e6c
linuxlinux>= 72246da40f3719af3bfd104a2365b32537c27d83 < afc0e34f161ce61ad351303c46eb57bd44b8b090afc0e34f161ce61ad351303c46eb57bd44b8b090
linuxlinux>= 72246da40f3719af3bfd104a2365b32537c27d83 < 7cfb62888eba292fa35cd9ddbd28ce595f60e1397cfb62888eba292fa35cd9ddbd28ce595f60e139
linuxlinux>= 72246da40f3719af3bfd104a2365b32537c27d83 < fa5eaf701e576880070b60922200557ae4aa54e1fa5eaf701e576880070b60922200557ae4aa54e1
linuxlinux>= 72246da40f3719af3bfd104a2365b32537c27d83 < e4037689a366743c4233966f0e74bc455820d316e4037689a366743c4233966f0e74bc455820d316
linuxlinux_kernel>= 0 < 5.10.247-15.10.247-1
linuxlinux_kernel>= 0 < 6.1.159-16.1.159-1
linuxlinux_kernel>= 0 < 6.12.63-16.12.63-1
linuxlinux_kernel>= 0 < 6.17.11-16.17.11-1
linuxlinux_kernel>= 0 < 5.15.0-173.1835.15.0-173.183
linuxlinux_kernel>= 0 < 6.8.0-106.1066.8.0-106.106
linuxlinux_kernel>= 0 < 6.17.0-19.196.17.0-19.19
linuxlinux_kernel>= 3.2.0 < 5.10.2475.10.247
linuxlinux_kernel>= 5.11.0 < 5.15.1975.15.197
linuxlinux_kernel>= 5.16.0 < 6.1.1596.1.159
linuxlinux_kernel>= 6.13.0 < 6.17.116.17.11
linuxlinux_kernel>= 6.2.0 < 6.6.1196.6.119
linuxlinux_kernel>= 6.7.0 < 6.12.616.12.61
msrcazl3_kernel_6.6.117.1-1_on_azure_linux_3.0
ubuntulinux-azure-5.15

CVSS provenance

osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.