CVE-2025-68282
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's USB gadget driver. It occurs due to a race condition during the gadget teardown process, where a concurrent event can schedule work on a gadget that is being cleaned up, leading to invalid memory access. The issue arises because work can be scheduled after a flush operation but before the gadget's memory is freed. The fix involves adding a 'teardown' flag and a 'state_lock' spinlock to prevent new work from being scheduled once cleanup starts, thus avoiding the race condition.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free memory access in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the race condition in the USB gadget driver during device removal.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your Linux kernel to a version that includes the patch fixing the use-after-free race condition in usb_gadget_state_work(). The patch introduces a 'teardown' flag and a 'state_lock' spinlock to prevent new work from being scheduled during gadget cleanup, thus resolving the race condition. Until the update is applied, avoid using USB gadget functionality that could trigger this race condition.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for KASAN (Kernel Address Sanitizer) reports indicating invalid memory access related to usb_gadget_state_work, such as the message: 'BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work'. To detect this on your system, you can check the kernel logs for such KASAN error messages using commands like 'dmesg | grep -i kasan' or 'journalctl -k | grep -i kasan'. Additionally, monitoring for kernel crashes or warnings related to usb gadget teardown may help. There are no specific network commands to detect this vulnerability as it is a kernel race condition related to USB gadget teardown.