FKIE_CVE-2025-68781
Vulnerability from fkie_nvd - Published: 2026-01-13 16:15 - Updated: 2026-04-15 00:35
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
The delayed work item otg_event is initialized in fsl_otg_conf() and
scheduled under two conditions:
1. When a host controller binds to the OTG controller.
2. When the USB ID pin state changes (cable insertion/removal).
A race condition occurs when the device is removed via fsl_otg_remove():
the fsl_otg instance may be freed while the delayed work is still pending
or executing. This leads to use-after-free when the work function
fsl_otg_event() accesses the already freed memory.
The problematic scenario:
(detach thread) | (delayed work)
fsl_otg_remove() |
kfree(fsl_otg_dev) //FREE| fsl_otg_event()
| og = container_of(...) //USE
| og-> //USE
Fix this by calling disable_delayed_work_sync() in fsl_otg_remove()
before deallocating the fsl_otg structure. This ensures the delayed work
is properly canceled and completes execution prior to memory deallocation.
This bug was identified through static analysis.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: phy: fsl-usb: Fix use-after-free in delayed work during device removal\n\nThe delayed work item otg_event is initialized in fsl_otg_conf() and\nscheduled under two conditions:\n1. When a host controller binds to the OTG controller.\n2. When the USB ID pin state changes (cable insertion/removal).\n\nA race condition occurs when the device is removed via fsl_otg_remove():\nthe fsl_otg instance may be freed while the delayed work is still pending\nor executing. This leads to use-after-free when the work function\nfsl_otg_event() accesses the already freed memory.\n\nThe problematic scenario:\n\n(detach thread) | (delayed work)\nfsl_otg_remove() |\n kfree(fsl_otg_dev) //FREE| fsl_otg_event()\n | og = container_of(...) //USE\n | og-\u003e //USE\n\nFix this by calling disable_delayed_work_sync() in fsl_otg_remove()\nbefore deallocating the fsl_otg structure. This ensures the delayed work\nis properly canceled and completes execution prior to memory deallocation.\n\nThis bug was identified through static analysis."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: phy: fsl-usb: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en trabajo retrasado durante la eliminaci\u00f3n del dispositivo\n\nEl elemento de trabajo retrasado otg_event se inicializa en fsl_otg_conf() y se programa bajo dos condiciones:\n1. Cuando un controlador de host se enlaza al controlador OTG.\n2. Cuando el estado del pin ID USB cambia (inserci\u00f3n/extracci\u00f3n de cable).\n\nUna condici\u00f3n de carrera ocurre cuando el dispositivo es eliminado a trav\u00e9s de fsl_otg_remove(): la instancia fsl_otg puede ser liberada mientras el trabajo retrasado a\u00fan est\u00e1 pendiente o ejecut\u00e1ndose. Esto lleva a un uso despu\u00e9s de liberaci\u00f3n cuando la funci\u00f3n de trabajo fsl_otg_event() accede a la memoria ya liberada.\n\nEl escenario problem\u00e1tico:\n\n(hilo de desvinculaci\u00f3n) | (trabajo retrasado)\nfsl_otg_remove() |\nkfree(fsl_otg_dev) //FREE| fsl_otg_event()\n| og = container_of(...) //USE\n| og-\u0026gt; //USE\n\nSolucione esto llamando a disable_delayed_work_sync() en fsl_otg_remove() antes de desasignar la estructura fsl_otg. Esto asegura que el trabajo retrasado sea cancelado correctamente y complete su ejecuci\u00f3n antes de la desasignaci\u00f3n de memoria.\n\nEste error fue identificado a trav\u00e9s de an\u00e1lisis est\u00e1tico."
}
],
"id": "CVE-2025-68781",
"lastModified": "2026-04-15T00:35:42.020",
"metrics": {},
"published": "2026-01-13T16:15:57.773",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/319f7a85b3c4e34ac2fe083eb146fe129a556317"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4476c73bbbb09b13a962176fca934b32d3954a2e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/69f9a0701abc3d1f8225074c56c27e6c16a37222"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Deferred"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…