CVE-2025-68282

CVE-2025-68282 is a use-after-free vulnerability in the Linux kernel's USB gadget subsystem, specifically within the usb_gadget_state_work() function. This flaw arises from a race condition during gadget teardown, where a new work item can be scheduled after previous attempts to flush the work queue, but before the gadget's memory is freed. The vulnerability is resolved by introducing a 'teardown' flag and 'state_lock' spinlock to prevent new work from being scheduled once cleanup has begun. While no CVSS score is provided, the vulnerability's nature as a race condition in kernel space suggests potential for denial of service or privilege escalation if exploited. The attack vector would likely involve specific timing during USB gadget device removal. The complexity of exploitation is not explicitly stated but typically requires precise timing and system knowledge. There is currently no evidence of active exploitation, nor are there any public exploit codes available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or immediate concern.