CVE-2025-68287: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
Vulnerability summary
CVE-2025-68287 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 14.2% of scored vulnerabilities.
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 51 · Related 40Timeline
- 16-12-2025PublishedVulnerability first disclosed.
- 16-06-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dwc3_remove_requests()`, leading to premature freeing of USB requests and subsequent crashes. Three distinct execution paths interact with `dwc3_remove_requests()`: Path 1: Triggered via `dwc3_gadget_reset_interrupt()` during USB reset handling. The call stack includes: - `dwc3_ep0_reset_state()` - `dwc3_ep0_stall_and_restart()` - `dwc3_ep0_out_start()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 2: Also initiated from `dwc3_gadget_reset_interrupt()`, but through `dwc3_stop_active_transfers()`. The call stack includes: - `dwc3_stop_active_transfers()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 3: Occurs independently during `adb root` execution, which triggers USB function unbind and bind operations. The sequence includes: - `gserial_disconnect()` - `usb_ep_disable()` - `dwc3_gadget_ep_disable()` - `dwc3_remove_requests()` with `-ESHUTDOWN` status Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions. To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue.
CVSS metrics
Risk metrics not yet published.
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.23% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: not stated in public data.
Ubuntu156 products
- linuxAll versions (No fix recorded) | < 5.15.0-173.183 | < 6.8.0-106.106 | < 6.17.0-19.19
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110 | < 6.8.0-1050.53 | < 6.17.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linux< 6.1.159-1 | < 6.12.63-1 | < 6.17.11-1
Linux1 product
- linux≥ 72246da40f3719af3bfd104a2365b32537c27d83, < 467add9db13219101f14b6cc5477998b4aaa5fe2 | ≥ 72246da40f3719af3bfd104a2365b32537c27d83, < 67192e8cb7f941b5bba91e4bb290683576ce1607 | ≥ 72246da40f3719af3bfd104a2365b32537c27d83, < 47de14d741cc4057046c9e2f33df1f7828254e6c | ≥ 72246da40f3719af3bfd104a2365b32537c27d83, < afc0e34f161ce61ad351303c46eb57bd44b8b090 | ≥ 72246da40f3719af3bfd104a2365b32537c27d83, < 7cfb62888eba292fa35cd9ddbd28ce595f60e139 | ≥ 72246da40f3719af3bfd104a2365b32537c27d83, < fa5eaf701e576880070b60922200557ae4aa54e1 | ≥ 72246da40f3719af3bfd104a2365b32537c27d83, < e4037689a366743c4233966f0e74bc455820d316 | 3.2
3 vendors · 158 products
