CVE-2025-68781

{
  "id": "CVE-2025-68781",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0807c500a1a6d7fa20cbd7bbe7fea14a66112463",
              "lessThan": "69f9a0701abc3d1f8225074c56c27e6c16a37222",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0807c500a1a6d7fa20cbd7bbe7fea14a66112463",
              "lessThan": "2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0807c500a1a6d7fa20cbd7bbe7fea14a66112463",
              "lessThan": "41ca62e3e21e48c2903b3b45e232cf4f2ff7434f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/usb/phy/phy-fsl-usb.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/usb/phy/phy-fsl-usb.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-13T16:15:57.773",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/69f9a0701abc3d1f8225074c56c27e6c16a37222",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: phy: fsl-usb: Fix use-after-free in delayed work during device removal\n\nThe delayed work item otg_event is initialized in fsl_otg_conf() and\nscheduled under two conditions:\n1. When a host controller binds to the OTG controller.\n2. When the USB ID pin state changes (cable insertion/removal).\n\nA race condition occurs when the device is removed via fsl_otg_remove():\nthe fsl_otg instance may be freed while the delayed work is still pending\nor executing. This leads to use-after-free when the work function\nfsl_otg_event() accesses the already freed memory.\n\nThe problematic scenario:\n\n(detach thread)            | (delayed work)\nfsl_otg_remove()           |\n  kfree(fsl_otg_dev) //FREE| fsl_otg_event()\n                           |   og = container_of(...) //USE\n                           |   og-> //USE\n\nFix this by calling disable_delayed_work_sync() in fsl_otg_remove()\nbefore deallocating the fsl_otg structure. This ensures the delayed work\nis properly canceled and completes execution prior to memory deallocation.\n\nThis bug was identified through static analysis."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: phy: fsl-usb: Corrección de uso después de liberación en trabajo retrasado durante la eliminación del dispositivo\n\nEl elemento de trabajo retrasado otg_event se inicializa en fsl_otg_conf() y se programa bajo dos condiciones:\n1. Cuando un controlador de host se enlaza al controlador OTG.\n2. Cuando el estado del pin ID USB cambia (inserción/extracción de cable).\n\nUna condición de carrera ocurre cuando el dispositivo es eliminado a través de fsl_otg_remove(): la instancia fsl_otg puede ser liberada mientras el trabajo retrasado aún está pendiente o ejecutándose. Esto lleva a un uso después de liberación cuando la función de trabajo fsl_otg_event() accede a la memoria ya liberada.\n\nEl escenario problemático:\n\n(hilo de desvinculación) | (trabajo retrasado)\nfsl_otg_remove() |\nkfree(fsl_otg_dev) //FREE| fsl_otg_event()\n| og = container_of(...) //USE\n| og-> //USE\n\nSolucione esto llamando a disable_delayed_work_sync() en fsl_otg_remove() antes de desasignar la estructura fsl_otg. Esto asegura que el trabajo retrasado sea cancelado correctamente y complete su ejecución antes de la desasignación de memoria.\n\nEste error fue identificado a través de análisis estático."
    }
  ],
  "lastModified": "2026-09-02T13:17:03.090",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}