usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (CVE-2025-68781) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2025-68781

usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal

Answer in brief

CVE-2025-68781 records a Unknown severity vulnerability in usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jan 13, 2026Updated Sep 2, 2026Source checked Sep 2, 2026First seen by HOL Sep 2, 2026Material review Sep 2, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=0807c500a1a6d7fa20cbd7bbe7fea14a66112463 <69f9a0701abc3d1f8225074c56c27e6c16a37222 \|\| >=0807c500a1a6d7fa20cbd7bbe7fea14a66112463 <2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23 \|\| >=0807c500a1a6d7fa20cbd7bbe7fea14a66112463 <41ca62e3e21e48c2903b3b45e232cf4f2ff7434f	69f9a0701abc3d1f8225074c56c27e6c16a37222, 2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23, 41ca62e3e21e48c2903b3b45e232cf4f2ff7434f
Linux/Linuxgeneric	3.0	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 69f9a0701abc3d1f8225074c56c27e6c16a37222 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jan 13, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 2, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 2, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is initialized in fsl_otg_conf() and scheduled under two conditions: 1. When a host controller binds to the OTG controller. 2. When the USB ID pin state changes (cable insertion/removal). A race condition occurs when the device is removed via fsl_otg_remove(): the fsl_otg instance may be freed while the delayed work is still pending or executing. This leads to use-after-free when the work function fsl_otg_event() accesses the already freed memory. The problematic scenario: (detach thread) | (delayed work) fsl_otg_remove() | kfree(fsl_otg_dev) //FREE| fsl_otg_event() | og = container_of(...) //USE | og-> //USE Fix this by calling disable_delayed_work_sync() in fsl_otg_remove() before deallocating the fsl_otg structure. This ensures the delayed work is properly canceled and completes execution prior to memory deallocation. This bug was identified through static analysis.

Quoted source text, attributed separately from HOL analysis.