Skip to content
Heist/ feed
Back to feed
UnratedFix available

usb: gadget: udc: fix use-after-free in usb_gadget_state_work

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.248, 5.15.198, 6.1.159, 6.12.61, 6.17.11, 6.6.119
CVEs
CVE-2025-68282
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 15:09 UTC · Revision 1

Source evidence

usb: gadget: udc: fix use-after-free in usb_gadget_state_work

core-osv · Original source

Published 16 Dec 2025, 15:06 UTC

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window.

osv:CVE-2025-68282

Kernel

Fixed versions: 5.10.248, 5.15.198, 6.1.159, 6.6.119, 6.12.61, 6.17.11

Complete source record
{
  "id": "5d7aa0b101072d0f86c16bf83186fb9f62a9aef65d468a96cc826ef610929bf8",
  "url": "https://osv.dev/vulnerability/CVE-2025-68282",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "usb: gadget: udc: fix use-after-free in usb_gadget_state_work",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c (\"usb: gadget: core: flush gadget workqueue after device removal\") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window.",
    "evidence": "osv:CVE-2025-68282",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.248",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.198",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.159",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.119",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.61",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.17.11",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2025-68282",
      "aliases": [
        "CVE-2025-68282"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15"
                },
                {
                  "fixed": "dddc944d65169b552e09cb54e3ed4fbb9ea26416"
                },
                {
                  "fixed": "eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5"
                },
                {
                  "fixed": "c12a0c3ef815ddd67e47f9c819f9fe822fed5467"
                },
                {
                  "fixed": "f02a412c0a18f02f0f91b0a3d9788315a721b7fd"
                },
                {
                  "fixed": "10014310193cf6736c1aeb4105c5f4a0818d0c65"
                },
                {
                  "fixed": "3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9"
                },
                {
                  "fixed": "baeb66fbd4201d1c4325074e78b1f557dff89b5b"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68282.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.12.0"
                },
                {
                  "fixed": "5.10.248"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.198"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.159"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.119"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.61"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.17.11"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68282.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.184942198Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/10014310193cf6736c1aeb4105c5f4a0818d0c65",
        "https://git.kernel.org/stable/c/3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9",
        "https://git.kernel.org/stable/c/baeb66fbd4201d1c4325074e78b1f557dff89b5b",
        "https://git.kernel.org/stable/c/c12a0c3ef815ddd67e47f9c819f9fe822fed5467",
        "https://git.kernel.org/stable/c/dddc944d65169b552e09cb54e3ed4fbb9ea26416",
        "https://git.kernel.org/stable/c/eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5",
        "https://git.kernel.org/stable/c/f02a412c0a18f02f0f91b0a3d9788315a721b7fd",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68282.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-68282",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68282.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-68282",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 504037,
  "published_at": "2025-12-16T15:06:04.332+00:00"
}