Medium · published March 7, 2025
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: core: flush gadget workqueue after device removal
device_del() can lead to new work being scheduled in gadget->work
workqueue. This is observed, for example, with the dwc3 driver with the
following call stack:
device_del()
gadget_unbind_driver()
usb_gadget_disconnect_locked()
dwc3_gadget_pullup()
dwc3_gadget_soft_disconnect()
usb_gadget_set_state()
schedule_work(&gadget->work)
Move flush_work() after device_del() to ensure the workqueue is cleaned
up.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.12, < 6.1.130 | 6.1.130 |
| linux/linux_kernel | ≥ 6.2, < 6.6.80 | 6.6.80 |
| linux/linux_kernel | ≥ 6.7, < 6.12.16 | 6.12.16 |
| linux/linux_kernel | ≥ 6.13, < 6.13.4 | 6.13.4 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |