CVE-2025-68287

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

This patch addresses a race condition caused by unsynchronized

execution of multiple call paths invoking `dwc3_remove_requests()`,

leading to premature freeing of USB requests and subsequent crashes.

Three distinct execution paths interact with `dwc3_remove_requests()`:

Path 1:

Triggered via `dwc3_gadget_reset_interrupt()` during USB reset

handling. The call stack includes:

- `dwc3_ep0_reset_state()`

- `dwc3_ep0_stall_and_restart()`

- `dwc3_ep0_out_start()`

- `dwc3_remove_requests()`

- `dwc3_gadget_del_and_unmap_request()`

Path 2:

Also initiated from `dwc3_gadget_reset_interrupt()`, but through

`dwc3_stop_active_transfers()`. The call stack includes:

- `dwc3_stop_active_transfers()`

- `dwc3_remove_requests()`

- `dwc3_gadget_del_and_unmap_request()`

Path 3:

Occurs independently during `adb root` execution, which triggers

USB function

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References