CVE-2025-68781: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
In the Linux kernel, the following vulnerability has been resolved:
usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
The delayed work item otgevent is initialized in fslotgconf() and scheduled under two conditions: 1. When a host controller binds to the OTG controller. 2. When the USB ID pin state changes (cable insertion/removal).
A race condition occurs when the device is removed via fslotgremove(): the fslotg instance may be freed while the delayed work is still pending or executing. This leads to use-after-free when the work function fslotgevent() accesses the already freed memory.
The problematic scenario:
(detach thread) | (delayed work) fslotgremove() | kfree(fslotgdev) //FREE| fslotgevent() | og = containerof(...) //USE | og-> //USE
Fix this by calling disabledelayedworksync() in fslotgremove() before deallocating the fslotg structure. This ensures the delayed work is properly canceled and completes execution prior to memory deallocation.
This bug was identified through static analysis.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the fsl-usb driver, fix the use-after-free by calling disable_delayed_work_sync() from fsl_otg_remove() to ensure otg_event delayed work is canceled and completes execution before any kfree(fsl_otg_dev) / memory deallocation.
Linux kernel (USB: phy: fsl-usb) disable delayed work (otg_event) during device removal in fsl_otg_remove() = Call disable_delayed_work_sync() in fsl_otg_remove() before deallocating fsl_otg structure
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68781?
CVE-2025-68781 has been classified as a medium severity vulnerability due to a use-after-free issue in the Linux kernel.
How do I fix CVE-2025-68781?
To fix CVE-2025-68781, update your Linux kernel to the latest stable release where this vulnerability has been patched.
What systems are affected by CVE-2025-68781?
CVE-2025-68781 affects Linux kernel implementations that utilize the fsl-usb phy driver.
What is the main impact of CVE-2025-68781?
The main impact of CVE-2025-68781 is the potential for a denial of service or unexpected behavior due to the use-after-free vulnerability.
Are there any workarounds for CVE-2025-68781?
Currently, the best approach for CVE-2025-68781 is to apply the kernel update as there are no known effective workarounds.