Junglewise Threat Intelligence

CVE-2025-68781: Linux kernel Freescale USB OTG use-after-free in delayed work

CVE-2025-68781 · Severity: info · Published 2026-01-13

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's Freescale USB OTG transceiver driver contains a use-after-free vulnerability in its device removal code. When a USB device is unplugged or the driver is unloaded, a delayed work function may access memory that has already been freed, potentially causing a kernel crash or memory corruption. This affects systems with Freescale-based USB controllers.

Technical details

This is a use-after-free race condition in the Freescale USB OTG transceiver driver (drivers/usb/phy/phy-fsl-usb.c). The vulnerability occurs between the fsl_otg_remove() function and the delayed work handler fsl_otg_event(). When a device is removed, fsl_otg_remove() frees the fsl_otg_dev structure, but a pending delayed work item may still be executing or scheduled, causing the work function to dereference freed memory via container_of(). The fix calls disable_delayed_work_sync() in fsl_otg_remove() before memory deallocation to ensure the delayed work completes or is canceled before the structure is freed. Attack vectors are limited to local unplugging/unloading, and patches have been integrated into the stable kernel tree.

Affected products

  • Linux Linux Kernel Multiple versions (Freescale USB OTG transceiver driver affected)

Timeline

  • 2025-12-05: disclosed: Fix committed by Duoming Zhou
  • 2025-12-17: patched: Patch merged into stable kernel tree
  • 2026-01-02: other: CVE published
  • 2026-01-13: other: Advisory published

References

Related threats