Linux Kernel USB Gadget Vulnerability in Driver Operations

CVE-2025-21838

Summary

A flaw has been identified in the Linux kernel's USB gadget subsystem, specifically during the device removal process. When a device is deleted, the function device_del() may inadvertently schedule new work in the device's workqueue, potentially leading to unexpected behavior or resource leaks. This issue has been exemplified in the dwc3 driver where improper handling during gadget disconnection could occur. To mitigate this vulnerability, it is essential to ensure that flush_work() is called following device_del() to effectively clean up the workqueue and prevent lingering tasks from executing.

References