LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68781: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal

In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is initialized in fsl_otg_conf() and scheduled under two conditions: 1. When a host controller binds to the OTG controller. 2. When the USB ID pin state changes (cable insertion/removal). A race condition occurs when the device is removed via fsl_otg_remove(): the fsl_otg instance may be freed while the delayed work is still pending or executing. This leads to use-after-free when the work function fsl_otg_event() accesses the already freed memory. The problematic scenario: (detach thread) | (delayed work) fsl_otg_remove() | kfree(fsl_otg_dev) //FREE| fsl_otg_event() | og = container_of(...) //USE | og-> //USE Fix this by calling disable_delayed_work_sync() in fsl_otg_remove() before deallocating the fsl_otg structure. This ensures the delayed work is properly canceled and completes execution prior to memory deallocation. This bug was identified through static analysis.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-68781 is a Linux kernel memory safety bug in the Freescale/FSL USB OTG driver. During device removal, queued delayed work can still run after the driver object is freed, causing a use-after-free. The source does not report active exploitation or a CVSS score.

Executive priority

Treat this as a targeted kernel maintenance issue, not an internet-wide emergency. Prioritize embedded, appliance, and hardware platforms using affected FSL USB OTG functionality, especially where kernel patching is slower or custom-built.

Technical view

The fsl-usb OTG driver schedules otg_event work during host-controller binding and USB ID-pin changes. fsl_otg_remove() could free fsl_otg_dev while fsl_otg_event() was pending or executing. The fix cancels and synchronizes delayed work before deallocation using disable_delayed_work_sync(). The bug was found by static analysis.

Likely exposure

Exposure is most likely on Linux systems using affected kernels with Freescale/FSL USB OTG controller support. Embedded or hardware-adjacent systems are the primary concern. The bundle provides kernel commit references but no distro-specific package status or CPE mapping.

Exploitation context

The CVE is not listed as KEV in the supplied bundle. The source says it was identified through static analysis and provides no evidence of exploitation, public proof-of-concept code, or weaponization.

Researcher notes

The vulnerable condition is a removal race between fsl_otg_remove() and fsl_otg_event(). Source evidence supports a use-after-free due to pending delayed work. Impact details, privilege requirements, and exploitability are not established in the supplied material.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • For custom kernels, backport the stable fsl-usb OTG delayed-work cancellation change.
  • Check Linux distribution advisories for package-specific fixed versions.
  • Prioritize systems with Freescale/FSL USB OTG hardware or enabled driver support.

Validation and detection

  • Inventory Linux kernel versions on systems using USB OTG hardware.
  • Confirm whether Freescale/FSL USB OTG driver support is enabled or loaded.
  • Compare kernel source or packages against the referenced stable commits.
  • Review vendor advisories for fixed downstream kernel package versions.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68781 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0807c500a1a6d7fa20cbd7bbe7fea14a66112463, 0807c500a1a6d7fa20cbd7bbe7fea14a66112463, 0807c500a1a6d7fa20cbd7bbe7fea14a66112463, 0807c500a1a6d7fa20cbd7bbe7fea14a66112463, 0807c500a1a6d7fa20cbd7bbe7fea14a66112463unaffected
LinuxLinux3.0, 0, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.