Not yet scoredPublished Dec 16, 2025

CVE-2025-68287usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

Updated under an hour ago (Oct 27, 2026, 5:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dwc3_remove_requests()`, leading to premature freeing of USB requests and subsequent crashes. Three distinct execution paths interact with `dwc3_remove_requests()`: Path 1: Triggered via `dwc3_gadget_reset_interrupt()` during USB reset handling. The call stack includes: - `dwc3_ep0_reset_state()` - `dwc3_ep0_stall_and_restart()` - `dwc3_ep0_out_start()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 2: Also initiated from `dwc3_gadget_reset_interrupt()`, but through `dwc3_stop_active_transfers()`. The call stack includes: - `dwc3_stop_active_transfers()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 3: Occurs independently during `adb root` execution, which triggers USB function unbind and bind operations. The sequence includes: - `gserial_disconnect()` - `usb_ep_disable()` - `dwc3_gadget_ep_disable()` - `dwc3_remove_requests()` with `-ESHUTDOWN` status Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions. To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	72246da40f3719af3bfd104a2365b32537c27d83 builds before 467add9db13219101f14b6cc5477998b4aaa5fe2; 72246da40f3719af3bfd104a2365b32537c27d83 builds before 67192e8cb7f941b5bba91e4bb290683576ce1607; 72246da40f3719af3bfd104a2365b32537c27d83 builds before 47de14d741cc4057046c9e2f33df1f7828254e6c; from 72246da40f3719af3bfd104a2365b32537c27d83 before afc0e34f161ce61ad351303c46eb57bd44b8b090; 72246da40f3719af3bfd104a2365b32537c27d83 builds before 7cfb62888eba292fa35cd9ddbd28ce595f60e139; from 72246da40f3719af3bfd104a2365b32537c27d83 before fa5eaf701e576880070b60922200557ae4aa54e1; from 72246da40f3719af3bfd104a2365b32537c27d83 before e4037689a366743c4233966f0e74bc455820d316	CNA record

References

References

https://git.kernel.org/stable/c/467add9db13219101f14b6cc5477998b4aaa5fe2
https://git.kernel.org/stable/c/67192e8cb7f941b5bba91e4bb290683576ce1607
https://git.kernel.org/stable/c/47de14d741cc4057046c9e2f33df1f7828254e6c
https://git.kernel.org/stable/c/afc0e34f161ce61ad351303c46eb57bd44b8b090
https://git.kernel.org/stable/c/7cfb62888eba292fa35cd9ddbd28ce595f60e139
https://git.kernel.org/stable/c/fa5eaf701e576880070b60922200557ae4aa54e1
https://git.kernel.org/stable/c/e4037689a366743c4233966f0e74bc455820d316

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.