CVE-2025-68312

Root

Cause

The vulnerability in the Linux kernel's usbnet driver stems from a race condition during device disconnection. When probing a usbnet device, usbnet_link_change(dev, 0, 0) schedules a kevent work item on the global workqueue. If the device is unregistered before this work item is scheduled, free_netdev() is called while the kevent is still pending, resulting in a "free active object" error and potential use-after-free [1]. Additionally, usbnet_disconnect() calls unregister_netdev(), which triggers ndo_stop() only if the device is up. However, if the device was never brought up, ndo_stop() does not execute, and the kevent remains unscheduled, exposing the same race [1].

Attack

Scenario

An attacker with physical access or the ability to trigger USB device hot-unplug events can exploit this flaw. No special privileges are required beyond the ability to disconnect a usbnet device while its driver is probing. The race window exists between scheduling the kevent and its execution, making the attack difficult but reproducible under controlled conditions.

Impact

Successful exploitation leads to a kernel panic or use-after-free, causing a denial of service (system crash). In theory, an attacker could leverage this memory corruption to escalate privileges, but the official description only confirms the crash as the immediate consequence [1].

Mitigation

The fix has been applied in the Linux kernel stable tree via commit [1]. Users are advised to update to a version containing this commit or any later kernel that includes the backport. No workaround is available besides applying the patch.