Junglewise Threat Intelligence

CVE-2025-21859: Linux Kernel deadlock in USB MIDI gadget driver

CVE-2025-21859 · Severity: medium · CVSS 5.5 · Published 2025-03-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB MIDI driver can cause a system deadlock, leading to a complete loss of availability for the affected device. This occurs when the system attempts to acquire the same internal lock twice during MIDI data transmission. An attacker with local access could exploit this to freeze the system, requiring a hard reboot and potentially disrupting operations or services relying on USB MIDI functionality.

Technical details

A deadlock vulnerability exists in the Linux kernel USB MIDI gadget driver (f_midi.c) due to improper locking (CWE-667). The issue occurs when f_midi_complete makes a re-entrant call to f_midi_transmit, which attempts to acquire a lock already held by the completion handler. This recursive lock acquisition results in a system deadlock. The vulnerability is triggered during USB MIDI data transmission. The fix involves offloading the inner f_midi_transmit call to a high-priority work queue using queue_work(), thereby breaking the re-entrant execution path. Patches have been released for multiple stable kernel branches including 6.1.130, 6.6.80, 6.12.17, and 6.13.5.

Affected products

  • Linux Linux Kernel versions from (including) 3.2 from (excluding) 6.1.130; versions from (including) 6.2 from (excluding) 6.6.80; versions from (including) 6.7 from (excluding) 6.12.17; versions from (including) 6.13 from (excluding) 6.13.5; 6.14-rc1; 6.14-rc2; 6.14-rc3

Timeline

  • 2025-02-11: patched: Initial patch authored
  • 2025-03-12: disclosed: CVE published

References

Related threats