CVE-2025-68327
Synchronous External Abort in Renesas USBHS on Unbind
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| renesas | renesas_usbhs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's Renesas USBHS driver for the Renesas RZ/G3S SoC. When the USB device is unbound after a specific configuration sequence, a synchronous external abort (a type of hardware fault) happens because the function usbhs_sys_function_pullup() tries to access hardware registers after the USBHS clocks have been disabled. This leads to a bus error due to accessing a module whose clock has been stopped, causing an internal error and system instability.
How can this vulnerability impact me? :
This vulnerability can cause a synchronous external abort, which is a serious hardware fault leading to an internal error and potential system crash or instability on devices using the Renesas RZ/G3S SoC with the affected USBHS driver. This could result in device malfunction or downtime when the USB device is unbound after the described configuration, impacting system reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the configuration and unbind sequence on a Renesas RZ/G3S SoC device and observing if a synchronous external abort occurs. The commands to reproduce the issue are: modprobe usb_f_ecm modprobe libcomposite modprobe configfs cd /sys/kernel/config/usb_gadget mkdir -p g1 cd g1 echo "0x1d6b" > idVendor echo "0x0104" > idProduct mkdir -p strings/0x409 echo "0123456789" > strings/0x409/serialnumber echo "Renesas." > strings/0x409/manufacturer echo "Ethernet Gadget" > strings/0x409/product mkdir -p functions/ecm.usb0 mkdir -p configs/c.1 mkdir -p configs/c.1/strings/0x409 echo "ECM" > configs/c.1/strings/0x409/configuration if [ ! -L configs/c.1/ecm.usb0 ]; then ln -s functions/ecm.usb0 configs/c.1 fi echo 11e20000.usb > UDC echo 11e20000.usb > /sys/bus/platform/drivers/renesas_usbhs/unbind If the system logs show an internal error with a synchronous external abort trace similar to the one described, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to ensure that the IP clocks are disabled at the end of the remove sequence to prevent usbhs_sys_function_pullup() from accessing IP registers after the USBHS clocks have been disabled. This involves applying the fix that disables the IP clocks properly during unbind/remove operations on the Renesas RZ/G3S SoC.