CVE-2025-21859: USB: gadget: f_midi: f_midi_complete to call queue_work
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: fmidi: fmidicomplete to call queuework
When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to fmiditransmit, causing a deadlock.
Fix it by using queuework() to schedule the inner fmiditransmit() via a high priority work queue from the completion handler.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.82.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.179.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21859?
CVE-2025-21859 has been classified as a high severity vulnerability due to its potential to cause a deadlock in USB MIDI operations.
What causes the deadlock in CVE-2025-21859?
The deadlock in CVE-2025-21859 is caused by a re-entrant call to f_midi_transmit that attempts to acquire a lock twice.
How do I fix CVE-2025-21859?
To fix CVE-2025-21859, update the Linux kernel to the latest version where the fix has been implemented using queue_work().
Which versions of the Linux kernel are affected by CVE-2025-21859?
CVE-2025-21859 affects various versions of the Linux kernel that implement USB MIDI functionality.
Is there a workaround for CVE-2025-21859 until a fix is applied?
Currently, there is no known workaround for CVE-2025-21859 other than upgrading the Linux kernel to a fixed version.