CVE-2025-68287 (GCVE-0-2025-68287)

Vulnerability from cvelistv5 – Published: 2025-12-16 15:06 – Updated: 2026-06-16 19:14
VLAI
Title
usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dwc3_remove_requests()`, leading to premature freeing of USB requests and subsequent crashes. Three distinct execution paths interact with `dwc3_remove_requests()`: Path 1: Triggered via `dwc3_gadget_reset_interrupt()` during USB reset handling. The call stack includes: - `dwc3_ep0_reset_state()` - `dwc3_ep0_stall_and_restart()` - `dwc3_ep0_out_start()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 2: Also initiated from `dwc3_gadget_reset_interrupt()`, but through `dwc3_stop_active_transfers()`. The call stack includes: - `dwc3_stop_active_transfers()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 3: Occurs independently during `adb root` execution, which triggers USB function unbind and bind operations. The sequence includes: - `gserial_disconnect()` - `usb_ep_disable()` - `dwc3_gadget_ep_disable()` - `dwc3_remove_requests()` with `-ESHUTDOWN` status Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions. To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 19:13 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7033 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < 467add9db13219101f14b6cc5477998b4aaa5fe2 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < 67192e8cb7f941b5bba91e4bb290683576ce1607 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < 47de14d741cc4057046c9e2f33df1f7828254e6c (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < afc0e34f161ce61ad351303c46eb57bd44b8b090 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < 7cfb62888eba292fa35cd9ddbd28ce595f60e139 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < fa5eaf701e576880070b60922200557ae4aa54e1 (git)
Affected: 72246da40f3719af3bfd104a2365b32537c27d83 , < e4037689a366743c4233966f0e74bc455820d316 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 5.10.247 , ≤ 5.10.* (semver)
Unaffected: 5.15.197 , ≤ 5.15.* (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.119 , ≤ 6.6.* (semver)
Unaffected: 6.12.61 , ≤ 6.12.* (semver)
Unaffected: 6.17.11 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68287",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:13:54.638944Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:14:09.159Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/ep0.c",
            "drivers/usb/dwc3/gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "467add9db13219101f14b6cc5477998b4aaa5fe2",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "67192e8cb7f941b5bba91e4bb290683576ce1607",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "47de14d741cc4057046c9e2f33df1f7828254e6c",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "afc0e34f161ce61ad351303c46eb57bd44b8b090",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "7cfb62888eba292fa35cd9ddbd28ce595f60e139",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "fa5eaf701e576880070b60922200557ae4aa54e1",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            },
            {
              "lessThan": "e4037689a366743c4233966f0e74bc455820d316",
              "status": "affected",
              "version": "72246da40f3719af3bfd104a2365b32537c27d83",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/ep0.c",
            "drivers/usb/dwc3/gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.119",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.61",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.11",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths\n\nThis patch addresses a race condition caused by unsynchronized\nexecution of multiple call paths invoking `dwc3_remove_requests()`,\nleading to premature freeing of USB requests and subsequent crashes.\n\nThree distinct execution paths interact with `dwc3_remove_requests()`:\nPath 1:\nTriggered via `dwc3_gadget_reset_interrupt()` during USB reset\nhandling. The call stack includes:\n- `dwc3_ep0_reset_state()`\n- `dwc3_ep0_stall_and_restart()`\n- `dwc3_ep0_out_start()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 2:\nAlso initiated from `dwc3_gadget_reset_interrupt()`, but through\n`dwc3_stop_active_transfers()`. The call stack includes:\n- `dwc3_stop_active_transfers()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 3:\nOccurs independently during `adb root` execution, which triggers\nUSB function unbind and bind operations. The sequence includes:\n- `gserial_disconnect()`\n- `usb_ep_disable()`\n- `dwc3_gadget_ep_disable()`\n- `dwc3_remove_requests()` with `-ESHUTDOWN` status\n\nPath 3 operates asynchronously and lacks synchronization with Paths\n1 and 2. When Path 3 completes, it disables endpoints and frees \u0027out\u0027\nrequests. If Paths 1 or 2 are still processing these requests,\naccessing freed memory leads to a crash due to use-after-free conditions.\n\nTo fix this added check for request completion and skip processing\nif already completed and added the request status for ep0 while queue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:50:14.760Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/467add9db13219101f14b6cc5477998b4aaa5fe2"
        },
        {
          "url": "https://git.kernel.org/stable/c/67192e8cb7f941b5bba91e4bb290683576ce1607"
        },
        {
          "url": "https://git.kernel.org/stable/c/47de14d741cc4057046c9e2f33df1f7828254e6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/afc0e34f161ce61ad351303c46eb57bd44b8b090"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cfb62888eba292fa35cd9ddbd28ce595f60e139"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa5eaf701e576880070b60922200557ae4aa54e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4037689a366743c4233966f0e74bc455820d316"
        }
      ],
      "title": "usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68287",
    "datePublished": "2025-12-16T15:06:08.711Z",
    "dateReserved": "2025-12-16T14:48:05.292Z",
    "dateUpdated": "2026-06-16T19:14:09.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68287",
      "date": "2026-10-31",
      "epss": "0.00232",
      "percentile": "0.14176"
    },
    "microsoft_vex": {
      "current_release_date": "2026-01-08T01:39:04.000Z",
      "cve": "CVE-2025-68287",
      "id": "msrc_CVE-2025-68287",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-68287.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc3/ep0.c",
                  "drivers/usb/dwc3/gadget.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "467add9db13219101f14b6cc5477998b4aaa5fe2",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "67192e8cb7f941b5bba91e4bb290683576ce1607",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47de14d741cc4057046c9e2f33df1f7828254e6c",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "afc0e34f161ce61ad351303c46eb57bd44b8b090",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7cfb62888eba292fa35cd9ddbd28ce595f60e139",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fa5eaf701e576880070b60922200557ae4aa54e1",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e4037689a366743c4233966f0e74bc455820d316",
                    "status": "affected",
                    "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc3/ep0.c",
                  "drivers/usb/dwc3/gadget.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.2"
                  },
                  {
                    "lessThan": "3.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.247",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.197",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.159",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.119",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.61",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths\n\nThis patch addresses a race condition caused by unsynchronized\nexecution of multiple call paths invoking `dwc3_remove_requests()`,\nleading to premature freeing of USB requests and subsequent crashes.\n\nThree distinct execution paths interact with `dwc3_remove_requests()`:\nPath 1:\nTriggered via `dwc3_gadget_reset_interrupt()` during USB reset\nhandling. The call stack includes:\n- `dwc3_ep0_reset_state()`\n- `dwc3_ep0_stall_and_restart()`\n- `dwc3_ep0_out_start()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 2:\nAlso initiated from `dwc3_gadget_reset_interrupt()`, but through\n`dwc3_stop_active_transfers()`. The call stack includes:\n- `dwc3_stop_active_transfers()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 3:\nOccurs independently during `adb root` execution, which triggers\nUSB function unbind and bind operations. The sequence includes:\n- `gserial_disconnect()`\n- `usb_ep_disable()`\n- `dwc3_gadget_ep_disable()`\n- `dwc3_remove_requests()` with `-ESHUTDOWN` status\n\nPath 3 operates asynchronously and lacks synchronization with Paths\n1 and 2. When Path 3 completes, it disables endpoints and frees \u0027out\u0027\nrequests. If Paths 1 or 2 are still processing these requests,\naccessing freed memory leads to a crash due to use-after-free conditions.\n\nTo fix this added check for request completion and skip processing\nif already completed and added the request status for ep0 while queue."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nusb: dwc3: Correcci\u00f3n de condici\u00f3n de carrera entre rutas de llamada concurrentes a dwc3_remove_requests()\n\nEste parche aborda una condici\u00f3n de carrera causada por la ejecuci\u00f3n no sincronizada de m\u00faltiples rutas de llamada que invocan a \u0027dwc3_remove_requests()\u0027, lo que lleva a la liberaci\u00f3n prematura de solicitudes USB y a fallos posteriores.\n\nTres rutas de ejecuci\u00f3n distintas interact\u00faan con \u0027dwc3_remove_requests()\u0027:\nRuta 1:\nSe activa a trav\u00e9s de \u0027dwc3_gadget_reset_interrupt()\u0027 durante el manejo del reinicio USB. La pila de llamadas incluye:\n- \u0027dwc3_ep0_reset_state()\u0027\n- \u0027dwc3_ep0_stall_and_restart()\u0027\n- \u0027dwc3_ep0_out_start()\u0027\n- \u0027dwc3_remove_requests()\u0027\n- \u0027dwc3_gadget_del_and_unmap_request()\u0027\n\nRuta 2:\nTambi\u00e9n se inicia desde \u0027dwc3_gadget_reset_interrupt()\u0027, pero a trav\u00e9s de \u0027dwc3_stop_active_transfers()\u0027. La pila de llamadas incluye:\n- \u0027dwc3_stop_active_transfers()\u0027\n- \u0027dwc3_remove_requests()\u0027\n- \u0027dwc3_gadget_del_and_unmap_request()\u0027\n\nRuta 3:\nOcurre de forma independiente durante la ejecuci\u00f3n de \u0027adb root\u0027, lo que activa operaciones de desvinculaci\u00f3n y vinculaci\u00f3n de funciones USB. La secuencia incluye:\n- \u0027gserial_disconnect()\u0027\n- \u0027usb_ep_disable()\u0027\n- \u0027dwc3_gadget_ep_disable()\u0027\n- \u0027dwc3_remove_requests()\u0027 con estado \u0027-ESHUTDOWN\u0027\n\nLa Ruta 3 opera de forma as\u00edncrona y carece de sincronizaci\u00f3n con las Rutas 1 y 2. Cuando la Ruta 3 finaliza, deshabilita los puntos finales y libera las solicitudes \u0027out\u0027. Si las Rutas 1 o 2 todav\u00eda est\u00e1n procesando estas solicitudes, el acceso a la memoria liberada provoca un fallo debido a condiciones de uso despu\u00e9s de liberaci\u00f3n.\n\nPara solucionar esto, se a\u00f1adi\u00f3 una comprobaci\u00f3n de finalizaci\u00f3n de solicitud y se omiti\u00f3 el procesamiento si ya estaba completada, y se a\u00f1adi\u00f3 el estado de la solicitud para ep0 durante la cola."
          }
        ],
        "id": "CVE-2025-68287",
        "lastModified": "2026-10-13T19:10:00.193",
        "metrics": {
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-68287",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:13:54.638944Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-16T16:16:07.510",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/467add9db13219101f14b6cc5477998b4aaa5fe2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47de14d741cc4057046c9e2f33df1f7828254e6c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/67192e8cb7f941b5bba91e4bb290683576ce1607"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7cfb62888eba292fa35cd9ddbd28ce595f60e139"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/afc0e34f161ce61ad351303c46eb57bd44b8b090"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e4037689a366743c4233966f0e74bc455820d316"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fa5eaf701e576880070b60922200557ae4aa54e1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-29T08:18:50+00:00",
      "cve": "CVE-2025-68287",
      "id": "CVE-2025-68287",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:fixed": "1561",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68287.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-68287",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-16T19:13:54.638944Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-16T19:14:00.548Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/usb/dwc3/ep0.c",
                "drivers/usb/dwc3/gadget.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "467add9db13219101f14b6cc5477998b4aaa5fe2",
                  "status": "affected",
                  "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                  "versionType": "git"
                },
                {
                  "lessThan": "67192e8cb7f941b5bba91e4bb290683576ce1607",
                  "status": "affected",
                  "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                  "versionType": "git"
                },
                {
                  "lessThan": "47de14d741cc4057046c9e2f33df1f7828254e6c",
                  "status": "affected",
                  "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                  "versionType": "git"
                },
                {
                  "lessThan": "afc0e34f161ce61ad351303c46eb57bd44b8b090",
                  "status": "affected",
                  "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                  "versionType": "git"
                },
                {
                  "lessThan": "7cfb62888eba292fa35cd9ddbd28ce595f60e139",
                  "status": "affected",
                  "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                  "versionType": "git"
                },
                {
                  "lessThan": "fa5eaf701e576880070b60922200557ae4aa54e1",
                  "status": "affected",
                  "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                  "versionType": "git"
                },
                {
                  "lessThan": "e4037689a366743c4233966f0e74bc455820d316",
                  "status": "affected",
                  "version": "72246da40f3719af3bfd104a2365b32537c27d83",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/usb/dwc3/ep0.c",
                "drivers/usb/dwc3/gadget.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.2"
                },
                {
                  "lessThan": "3.2",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.247",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.197",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.159",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.119",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.61",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.17.*",
                  "status": "unaffected",
                  "version": "6.17.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.18",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.247",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.197",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.159",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.119",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.61",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17.11",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18",
                      "versionStartIncluding": "3.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths\n\nThis patch addresses a race condition caused by unsynchronized\nexecution of multiple call paths invoking `dwc3_remove_requests()`,\nleading to premature freeing of USB requests and subsequent crashes.\n\nThree distinct execution paths interact with `dwc3_remove_requests()`:\nPath 1:\nTriggered via `dwc3_gadget_reset_interrupt()` during USB reset\nhandling. The call stack includes:\n- `dwc3_ep0_reset_state()`\n- `dwc3_ep0_stall_and_restart()`\n- `dwc3_ep0_out_start()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 2:\nAlso initiated from `dwc3_gadget_reset_interrupt()`, but through\n`dwc3_stop_active_transfers()`. The call stack includes:\n- `dwc3_stop_active_transfers()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 3:\nOccurs independently during `adb root` execution, which triggers\nUSB function unbind and bind operations. The sequence includes:\n- `gserial_disconnect()`\n- `usb_ep_disable()`\n- `dwc3_gadget_ep_disable()`\n- `dwc3_remove_requests()` with `-ESHUTDOWN` status\n\nPath 3 operates asynchronously and lacks synchronization with Paths\n1 and 2. When Path 3 completes, it disables endpoints and frees \u0027out\u0027\nrequests. If Paths 1 or 2 are still processing these requests,\naccessing freed memory leads to a crash due to use-after-free conditions.\n\nTo fix this added check for request completion and skip processing\nif already completed and added the request status for ep0 while queue."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T21:50:14.760Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/467add9db13219101f14b6cc5477998b4aaa5fe2"
            },
            {
              "url": "https://git.kernel.org/stable/c/67192e8cb7f941b5bba91e4bb290683576ce1607"
            },
            {
              "url": "https://git.kernel.org/stable/c/47de14d741cc4057046c9e2f33df1f7828254e6c"
            },
            {
              "url": "https://git.kernel.org/stable/c/afc0e34f161ce61ad351303c46eb57bd44b8b090"
            },
            {
              "url": "https://git.kernel.org/stable/c/7cfb62888eba292fa35cd9ddbd28ce595f60e139"
            },
            {
              "url": "https://git.kernel.org/stable/c/fa5eaf701e576880070b60922200557ae4aa54e1"
            },
            {
              "url": "https://git.kernel.org/stable/c/e4037689a366743c4233966f0e74bc455820d316"
            }
          ],
          "title": "usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-68287",
        "datePublished": "2025-12-16T15:06:08.711Z",
        "dateReserved": "2025-12-16T14:48:05.292Z",
        "dateUpdated": "2026-06-16T19:14:09.159Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.