CVE-2025-68781: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68781 is a use-after-free vulnerability in the Linux kernel's Freescale USB OTG (On-The-Go) physical layer driver (usb: phy: fsl-usb). A race condition during device removal via fsl_otg_remove() can result in the fsl_otg structure being freed while the delayed work item otg_event is still pending or executing, causing fsl_otg_event() to access already-freed memory. The vulnerability was identified through static analysis and disclosed on January 13, 2026. No official CVSS score has been assigned by NVD; Feedly estimates the severity as Medium with an EPSS score of 0.000180 (Feedly, NVD).

The root cause is a use-after-free (CWE-416) triggered by a time-of-check/time-of-use race condition in the Linux kernel's drivers/usb/phy/phy-fsl-usb.c. The otg_event delayed work item is initialized in fsl_otg_conf() and scheduled when a host controller binds to the OTG controller or when the USB ID pin state changes. During device removal, fsl_otg_remove() calls kfree(fsl_otg_dev) without first ensuring the delayed work has completed, allowing fsl_otg_event() to execute concurrently and dereference the freed fsl_otg structure via container_of(). The fix adds a call to disable_delayed_work_sync() in fsl_otg_remove() before memory deallocation, ensuring the work is canceled and fully completed before the structure is freed (NVD, Feedly).

Successful exploitation could lead to kernel memory corruption, system instability, or denial of service (kernel panic/crash). The vulnerability primarily affects availability, as corrupted kernel memory may cause unpredictable system behavior. Exploitation requires local access to a system with a Freescale USB controller and the ability to trigger USB device hot-plugging or mode switching, limiting the scope to embedded or industrial systems using Freescale/NXP hardware (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.000180, reflecting minimal exploitation probability. Exploitation requires local access and the ability to trigger a specific race condition window during USB device removal, making opportunistic exploitation unlikely (Feedly).

Patches have been integrated into the following Linux kernel stable branches: 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc3 or later. Downstream distributions including Debian (linux 6.1.162-1, DLA-4476-1) and Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1) have also released updated packages. If immediate patching is not possible, consider disabling the Freescale USB OTG driver if it is not required, or limiting USB hot-plugging on affected systems. Monitor kernel logs for OTG-related errors or unexpected crashes as a precautionary measure (Feedly, Debian LTS, Ubuntu USN-8177-1).