Executive brief
A vulnerability in the Linux kernel's USB driver could allow a local user to cause a system crash. This occurs during rapid connecting and disconnecting of USB devices on certain hardware platforms. If the system is configured to halt on warnings, these common hardware events can trigger a full system failure, impacting operational availability.
Technical details
A vulnerability classified as a Reachable Assertion (CWE-617) exists in the Linux kernel's dwc3 USB driver. The issue stems from the use of WARN_ON macros when device endpoint commands timeout, which is a condition that can occur naturally during fast software-controlled connect/disconnect sequences on Exynos and other platforms. If the kernel is booted with 'panic_on_warn' enabled, these timeouts trigger a kernel panic; otherwise, they generate unnecessary call traces. The fix involves replacing the WARN_ON assertions with rate-limited error logging to handle these expected hardware timing scenarios gracefully. The vulnerability is reachable by a local user capable of triggering USB gadget state changes.
Affected products
- Linux Linux kernel up to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4
Timeline
- 2025-09-15: disclosed
- 2025-09-15: advisory
- 2025-08-17: patched: Initial patch committed to stable tree
References
- https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f
- https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8
- https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9
- https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2
- https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f
- https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html