CVE-2025-21838: usb: gadget: core: flush gadget workqueue after device removal
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: core: flush gadget workqueue after device removal
devicedel() can lead to new work being scheduled in gadget->work workqueue. This is observed, for example, with the dwc3 driver with the following call stack: devicedel() gadgetunbinddriver() usbgadgetdisconnectlocked() dwc3gadgetpullup() dwc3gadgetsoftdisconnect() usbgadgetsetstate() schedulework(&gadget->work)
Move flushwork() after devicedel() to ensure the workqueue is cleaned up.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21838?
CVE-2025-21838 has been categorized with a medium severity level due to its potential impact on system stability.
How do I fix CVE-2025-21838?
To fix CVE-2025-21838, ensure that you update your Linux kernel to the latest stable release that addresses this vulnerability.
What systems are affected by CVE-2025-21838?
CVE-2025-21838 affects the Linux kernel, specifically impacting systems that utilize the USB gadget functionality.
What can happen if CVE-2025-21838 is exploited?
Exploitation of CVE-2025-21838 could lead to unexpected behavior or crashes related to the USB gadgets on affected systems.
When was CVE-2025-21838 published?
CVE-2025-21838 was published in 2025 after being identified in the Linux kernel.