Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-21859

USB: gadget: f_midi: f_midi_complete to call queue_work

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.291, 5.10.235, 5.15.179, 6.1.130, 6.6.80, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: f_midi: f_midi_complete to call queue_work When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to f_midi_transmit, causing a deadlock. Fix it by using queue_work() to schedule the inner f_midi_transmit() via a high priority work queue from the completion handler.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From d5daf49b58661ec4af7a55b277176efbf945ca05 · fixed in 727dee0857946b85232526de4f5a957fe163e89a; From d5daf49b58661ec4af7a55b277176efbf945ca05 · fixed in 1f10923404705a94891e612dff3b75e828a78368; From d5daf49b58661ec4af7a55b277176efbf945ca05 · fixed in b09957657d7767d164b3432af2129bd72947553c; From d5daf49b58661ec4af7a55b277176efbf945ca05 · fixed in 24a942610ee9bafb2692a456ae850c5b2e409b05; From d5daf49b58661ec4af7a55b277176efbf945ca05 · fixed in deeee3adb2c01eedab32c3b4519337689ad02e8a; From d5daf49b58661ec4af7a55b277176efbf945ca05 · fixed in e9fec6f42c45db2f62dc373fb1a10d2488c04e79; From d5daf49b58661ec4af7a55b277176efbf945ca05 · fixed in 8aa6b4be1f4efccbfc533e6ec8841d26e4fa8dba; From d5daf49b58661ec4af7a55b277176efbf945ca05 · fixed in 4ab37fcb42832cdd3e9d5e50653285ca84d6686f

  • Linux Linux

    3.2

  • KernelLinux

    From 3.2.0 · fixed in 5.4.291; From 5.5.0 · fixed in 5.10.235; From 5.11.0 · fixed in 5.15.179; From 5.16.0 · fixed in 6.1.130; From 6.2.0 · fixed in 6.6.80; From 6.7.0 · fixed in 6.12.17; From 6.13.0 · fixed in 6.13.5

References 8

git.kernel.org