CVE-2025-68312

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usbnet: Prevents free active kevent

The root cause of this issue are:

1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0);

put the kevent work in global workqueue. However, the kevent has not yet

been scheduled when the usbnet device is unregistered. Therefore, executing

free_netdev() results in the "free active object (kevent)" error reported

here.

2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(),

if the usbnet device is up, ndo_stop() is executed to cancel the kevent.

However, because the device is not up, ndo_stop() is not executed.

The solution to this problem is to cancel the kevent before executing

free_netdev().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References