LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21838: usb: gadget: core: flush gadget workqueue after device removal

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: flush gadget workqueue after device removal device_del() can lead to new work being scheduled in gadget->work workqueue. This is observed, for example, with the dwc3 driver with the following call stack: device_del() gadget_unbind_driver() usb_gadget_disconnect_locked() dwc3_gadget_pullup() dwc3_gadget_soft_disconnect() usb_gadget_set_state() schedule_work(&gadget->work) Move flush_work() after device_del() to ensure the workqueue is cleaned up.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue concerns cleanup after removing a USB gadget device. The kernel could schedule new gadget work during removal, so cleanup happened too early. Business impact is unclear because the source bundle provides no CVSS score, exploitation evidence, or defined attacker path.

Executive priority

Treat as targeted remediation for Linux device-mode USB environments, not an all-fleet emergency based on current evidence. Prioritize affected embedded or appliance products and include it in normal kernel update cycles unless vendor guidance elevates urgency.

Technical view

The bug is in Linux USB gadget core workqueue ordering. device_del() can trigger gadget_unbind_driver(), disconnect logic, and schedule_work(&gadget->work), observed with dwc3. The fix moves flush_work() after device_del() so pending or newly scheduled gadget work is drained after removal.

Likely exposure

Exposure is most plausible on Linux systems using USB gadget functionality, especially embedded, appliance, mobile, or USB device-mode platforms. The bundle does not prove general server exposure, remote reachability, or required local privileges. Linux kernel versions identified in the CVE record should be checked against vendor backports.

Exploitation context

No active exploitation is supported by the provided sources, and the CVE is not marked KEV. The source bundle describes a kernel cleanup race/order issue, not a public exploit, exploit technique, or confirmed attacker workflow.

Researcher notes

The available evidence is limited to the CVE text, Linux stable commit references, and a Debian LTS advisory. No CWE, CVSS vector, exploitability prerequisites, crash primitive, or post-fix regression details are provided in the bundle.

Mitigation direction

  • Apply vendor kernel updates containing the linked upstream stable fixes.
  • Follow Debian LTS guidance if using Debian LTS kernels.
  • Check Linux distribution advisories for backported fixes.
  • Prioritize systems with USB gadget or dwc3 functionality enabled.

Validation and detection

  • Inventory running kernel versions against the CVE record and vendor advisories.
  • Confirm whether USB gadget functionality is built, loaded, or enabled.
  • Verify the relevant stable commit or vendor backport is present.
  • Review embedded and appliance images separately from standard server fleets.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21838 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15, 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15, 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15, 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15, 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15unaffected
LinuxLinux3.12, 0, 6.1.130, 6.6.80, 6.12.16, 6.13.4, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.