CVE-2025-38376

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume

Shawn and John reported a hang issue during system suspend as below:

- USB gadget is enabled as Ethernet

- There is data transfer over USB Ethernet (scp a big file between host

and device)

- Device is going in/out suspend (echo mem > /sys/power/state)

The root cause is the USB device controller is suspended but the USB bus

is still active which caused the USB host continues to transfer data with

device and the device continues to queue USB requests (in this case, a

delayed TCP ACK packet trigger the issue) after controller is suspended,

however the USB controller clock is already gated off. Then if udc driver

access registers after that point, the system will hang.

The correct way to avoid such issue is to disconnect device from host when

the USB bus is not at suspend state. Then the host will

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References