CVE-2025-68282

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: udc: fix use-after-free in usb_gadget_state_work

A race condition during gadget teardown can lead to a use-after-free

in usb_gadget_state_work(), as reported by KASAN:

BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0

Workqueue: events usb_gadget_state_work

The fundamental race occurs because a concurrent event (e.g., an

interrupt) can call usb_gadget_set_state() and schedule gadget->work

at any time during the cleanup process in usb_del_gadget().

Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after

device removal") attempted to fix this by moving flush_work() to after

device_del(). However, this does not fully solve the race, as a new

work item can still be scheduled *after* flush_work() completes but

before the gadget's memory is freed, leading to the same use-after-free.

This patch fixes the race condition robustly by introducing a 'teardown'

flag and a 'state_lock' spinloc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References