In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON...

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: Remove WARN_ON for device endpoint command timeouts

This commit addresses a rarely observed endpoint command timeout
which causes kernel panic due to warn when 'panic_on_warn' is enabled
and unnecessary call trace prints when 'panic_on_warn' is disabled.
It is seen during fast software-controlled connect/disconnect testcases.
The following is one such endpoint command timeout that we observed:

  1. Connect
    =======
    ->dwc3_thread_interrupt
    ->dwc3_ep0_interrupt
    ->configfs_composite_setup
    ->composite_setup
    ->usb_ep_queue
    ->dwc3_gadget_ep0_queue
    ->__dwc3_gadget_ep0_queue
    ->__dwc3_ep0_do_control_data
    ->dwc3_send_gadget_ep_cmd

  2. Disconnect
    ==========
    ->dwc3_thread_interrupt
    ->dwc3_gadget_disconnect_interrupt
    ->dwc3_ep0_reset_state
    ->dwc3_ep0_end_control_data
    ->dwc3_send_gadget_ep_cmd

In the issue scenario, in Exynos platforms, we observed that control
transfers for the previous connect have not yet been completed and end
transfer command sent as a part of the disconnect sequence and
processing of USB_ENDPOINT_HALT feature request from the host timeout.
This maybe an expected scenario since the controller is processing EP
commands sent as a part of the previous connect. It maybe better to
remove WARN_ON in all places where device endpoint commands are sent to
avoid unnecessary kernel panic due to warn.

Basic information

Type
unreviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Source code
Not specified
Published (advisory)
2025-09-15 15:31:21 UTC
Updated
2026-05-12 15:31:08 UTC
NVD published
2025-09-15

EPSS Score

Score Percentile
0.02% 3.81%

CVSS Scores

Base score Version Severity Vector
5.5 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.

Identifiers

CWEs

CWE id Name
CWE-617 Reachable Assertion

References

cvelogic Threat Intelligence