CVE-2025-68282: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68282 is a use-after-free vulnerability in the Linux kernel's USB gadget subsystem, specifically in the usb_gadget_state_work() function. A race condition during gadget teardown allows a concurrent event (e.g., an interrupt) to call usb_gadget_set_state() and schedule work after flush_work() completes but before the gadget's memory is freed. The vulnerability affects Linux kernel versions from 3.12 up to the patched releases (6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18). It was published on December 16, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a race condition (CWE-416: Use After Free) in the USB gadget core during device teardown. When usb_del_gadget() is called, a concurrent interrupt can invoke usb_gadget_set_state(), which schedules gadget->work after flush_work() has already completed — but before the gadget struct's memory is freed — resulting in a use-after-free access reported by KASAN as BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0. A prior fix (commit 399a45e5237c) attempted to address this by moving flush_work() after device_del(), but failed to close the full race window. The fix introduces a teardown flag and a state_lock spinlock to the usb_gadget struct; usb_gadget_set_state() now checks the flag under the lock before queuing work, preventing new work items from being scheduled once cleanup has commenced (Red Hat CVE).

Successful exploitation by a local low-privileged attacker could cause a system crash (denial of service) or potentially enable arbitrary code execution in kernel context. The primary impact is high availability loss due to kernel panic or instability; there is no direct confidentiality or integrity impact per the CVSS assessment. The vulnerability is confined to systems with USB gadget functionality enabled and does not facilitate network-based lateral movement (Red Hat CVE, Feedly).

• Logs: KASAN kernel log entries such as BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 or Workqueue: events usb_gadget_state_work in /var/log/kern.log or dmesg output.
• Process/Kernel: Unexpected kernel panics or oops messages associated with USB gadget workqueue events during device removal or teardown sequences.
• System Behavior: System instability or crashes correlated with USB gadget device connect/disconnect events, particularly on systems acting as USB device controllers.

Apply the upstream kernel patches included in the following stable releases: 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18. Distribution-specific updates are available from Red Hat, Debian (DLA-4436-1, DLA-4475-1), Ubuntu (USN-8096-1/2/3/5, USN-8094-2/3/4/5, USN-8152-1), Oracle Linux, and Microsoft Azure Linux (azl3 kernel 6.6.117.1-1). As a workaround where patching is not immediately possible, restrict local user access to systems with USB gadget functionality and avoid hot-plugging USB gadget devices on unpatched kernels (Red Hat CVE, Debian LTS, Ubuntu USN-8096-1).