CVE-2025-39801
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-15 13:15:35.580000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-39801",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-15T13:15:35.580",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when 'panic_on_warn' is enabled\nand unnecessary call trace prints when 'panic_on_warn' is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n =======\n->dwc3_thread_interrupt\n ->dwc3_ep0_interrupt\n ->configfs_composite_setup\n ->composite_setup\n ->usb_ep_queue\n ->dwc3_gadget_ep0_queue\n ->__dwc3_gadget_ep0_queue\n ->__dwc3_ep0_do_control_data\n ->dwc3_send_gadget_ep_cmd\n\n2. Disconnect\n ==========\n->dwc3_thread_interrupt\n ->dwc3_gadget_disconnect_interrupt\n ->dwc3_ep0_reset_state\n ->dwc3_ep0_end_control_data\n ->dwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: dwc3: Eliminar WARN_ON para los tiempos de espera de comandos de punto final de dispositivo\n\nEsta confirmación aborda un tiempo de espera de comando de punto final raramente observado que causa pánico del kernel debido a una advertencia cuando 'panic_on_warn' está habilitado y rastreos de llamadas innecesarios cuando 'panic_on_warn' está deshabilitado. Se observa durante casos de prueba de conexión/desconexión rápidos controlados por software. El siguiente es uno de esos tiempos de espera de comandos de punto final que observamos:\n\n1. Conectar\n =======\n->dwc3_thread_interrupt\n ->dwc3_ep0_interrupt\n ->configfs_composite_setup\n ->composite_setup\n ->usb_ep_queue\n ->dwc3_gadget_ep0_queue\n ->__dwc3_gadget_ep0_queue\n ->__dwc3_ep0_do_control_data\n ->dwc3_send_gadget_ep_cmd\n\n2. Desconectar\n ==========\n->dwc3_thread_interrupt\n ->dwc3_gadget_disconnect_interrupt\n ->dwc3_ep0_reset_state\n ->dwc3_ep0_end_control_data\n ->dwc3_send_gadget_ep_cmd\n\nEn el escenario del problema, en plataformas Exynos, observamos que las transferencias de control para la conexión anterior aún no se han completado y el comando de finalización de transferencia enviado como parte de la secuencia de desconexión y el procesamiento de la solicitud de característica USB_ENDPOINT_HALT del host agotan el tiempo de espera. Este podría ser un escenario esperado ya que el controlador está procesando comandos de EP enviados como parte de la conexión anterior. Podría ser mejor eliminar WARN_ON en todos los lugares donde se envían comandos de punto final de dispositivo para evitar pánicos del kernel innecesarios debido a una advertencia."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/usb/dwc3/ep0.c",
"drivers/usb/dwc3/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "72246da40f3719af3bfd104a2365b32537c27d83",
"lessThan": "dfe40159eec6ca63b40133bfa783eee2e3ed829f",
"versionType": "git",
"status": "affected"
},
{
"version": "72246da40f3719af3bfd104a2365b32537c27d83",
"lessThan": "5a1a847d841505dba2bd85602daf5c218e1d85b8",
"versionType": "git",
"status": "affected"
},
{
"version": "72246da40f3719af3bfd104a2365b32537c27d83",
"lessThan": "84c95dbf5bece56086cdb65a64162af35158bdd9",
"versionType": "git",
"status": "affected"
},
{
"version": "72246da40f3719af3bfd104a2365b32537c27d83",
"lessThan": "f49697dfba2915a9ff36f94604eb76fa61413929",
"versionType": "git",
"status": "affected"
},
{
"version": "72246da40f3719af3bfd104a2365b32537c27d83",
"lessThan": "db27482b9db340402e05d4e9b75352bbaca51af2",
"versionType": "git",
"status": "affected"
},
{
"version": "72246da40f3719af3bfd104a2365b32537c27d83",
"lessThan": "45eae113dccaf8e502090ecf5b3d9e9b805add6f",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/usb/dwc3/ep0.c",
"drivers/usb/dwc3/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.2",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.2",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.190",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.149",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.103",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.44",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.4",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC CN 4100",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V5.0",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-617"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2",
"versionEndExcluding": "5.15.190",
"matchCriteriaId": "F47280F2-824C-4F32-9522-BEC57DD4A405"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.149",
"matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.103",
"matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.44",
"matchCriteriaId": "12351F24-1133-4775-960C-F2B47E81298B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.16.4",
"matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
"matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}