CVE-2025-22023

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Don't skip on Stopped - Length Invalid

Up until commit d56b0b2ab142 ("usb: xhci: ensure skipped isoc TDs are

returned when isoc ring is stopped") in v6.11, the driver didn't skip

missed isochronous TDs when handling Stoppend and Stopped - Length

Invalid events. Instead, it erroneously cleared the skip flag, which

would cause the ring to get stuck, as future events won't match the

missed TD which is never removed from the queue until it's cancelled.

This buggy logic seems to have been in place substantially unchanged

since the 3.x series over 10 years ago, which probably speaks first

and foremost about relative rarity of this case in normal usage, but

by the spec I see no reason why it shouldn't be possible.

After d56b0b2ab142, TDs are immediately skipped when handling those

Stopped events. This poses a potential problem in case of Stopped -

Length Invalid, which occurs either on completed TDs (likely alr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References