SB20250916323 - Resource management error in Linux kernel usb dwc3 driver
Published: September 16, 2025
Security Bulletin ID
SB20250916323
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Resource management error (CVE-ID: CVE-2025-39801)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to resource management error within the __dwc3_stop_active_transfer() and dwc3_clear_stall_all_ep() functions in drivers/usb/dwc3/gadget.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f
- https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8
- https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9
- https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2
- https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f
- https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929