CVE-2025-39801

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39801", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.134Z", "datePublished": "2025-09-15T12:36:43.936Z", "dateUpdated": "2026-11-05T21:12:58.732Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:36:32.006Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when 'panic_on_warn' is enabled\nand unnecessary call trace prints when 'panic_on_warn' is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n =======\n->dwc3_thread_interrupt\n ->dwc3_ep0_interrupt\n ->configfs_composite_setup\n ->composite_setup\n ->usb_ep_queue\n ->dwc3_gadget_ep0_queue\n ->__dwc3_gadget_ep0_queue\n ->__dwc3_ep0_do_control_data\n ->dwc3_send_gadget_ep_cmd\n\n2. Disconnect\n ==========\n->dwc3_thread_interrupt\n ->dwc3_gadget_disconnect_interrupt\n ->dwc3_ep0_reset_state\n ->dwc3_ep0_end_control_data\n ->dwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/dwc3/ep0.c", "drivers/usb/dwc3/gadget.c"], "versions": [{"version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "dfe40159eec6ca63b40133bfa783eee2e3ed829f", "status": "affected", "versionType": "git"}, {"version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "5a1a847d841505dba2bd85602daf5c218e1d85b8", "status": "affected", "versionType": "git"}, {"version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "84c95dbf5bece56086cdb65a64162af35158bdd9", "status": "affected", "versionType": "git"}, {"version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "f49697dfba2915a9ff36f94604eb76fa61413929", "status": "affected", "versionType": "git"}, {"version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "db27482b9db340402e05d4e9b75352bbaca51af2", "status": "affected", "versionType": "git"}, {"version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "45eae113dccaf8e502090ecf5b3d9e9b805add6f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/dwc3/ep0.c", "drivers/usb/dwc3/gadget.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.44", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.16.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f"}, {"url": "https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8"}, {"url": "https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9"}, {"url": "https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929"}, {"url": "https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2"}, {"url": "https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f"}], "title": "usb: dwc3: Remove WARN_ON for device endpoint command timeouts", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:43:31.805Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:07:10.119Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39801", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:11:47.846641Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:12:58.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:43:31.805Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:07:10.119Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39801", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:11:47.846641Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:11:49.715Z"}}], "cna": {"title": "usb: dwc3: Remove WARN_ON for device endpoint command timeouts", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "dfe40159eec6ca63b40133bfa783eee2e3ed829f", "versionType": "git"}, {"status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "5a1a847d841505dba2bd85602daf5c218e1d85b8", "versionType": "git"}, {"status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "84c95dbf5bece56086cdb65a64162af35158bdd9", "versionType": "git"}, {"status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "f49697dfba2915a9ff36f94604eb76fa61413929", "versionType": "git"}, {"status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "db27482b9db340402e05d4e9b75352bbaca51af2", "versionType": "git"}, {"status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "lessThan": "45eae113dccaf8e502090ecf5b3d9e9b805add6f", "versionType": "git"}], "programFiles": ["drivers/usb/dwc3/ep0.c", "drivers/usb/dwc3/gadget.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"status": "unaffected", "version": "0", "lessThan": "3.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.190", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.149", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.103", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.44", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.4", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/dwc3/ep0.c", "drivers/usb/dwc3/gadget.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f"}, {"url": "https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8"}, {"url": "https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9"}, {"url": "https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929"}, {"url": "https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2"}, {"url": "https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when 'panic_on_warn' is enabled\nand unnecessary call trace prints when 'panic_on_warn' is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n =======\n->dwc3_thread_interrupt\n ->dwc3_ep0_interrupt\n ->configfs_composite_setup\n ->composite_setup\n ->usb_ep_queue\n ->dwc3_gadget_ep0_queue\n ->__dwc3_gadget_ep0_queue\n ->__dwc3_ep0_do_control_data\n ->dwc3_send_gadget_ep_cmd\n\n2. Disconnect\n ==========\n->dwc3_thread_interrupt\n ->dwc3_gadget_disconnect_interrupt\n ->dwc3_ep0_reset_state\n ->dwc3_ep0_end_control_data\n ->dwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.190", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.149", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.103", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.44", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.4", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "3.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:36:32.006Z"}}}, "cveMetadata": {"cveId": "CVE-2025-39801", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:12:58.732Z", "dateReserved": "2025-04-16T07:20:57.134Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-09-15T12:36:43.936Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/dwc3/ep0.c", "drivers/usb/dwc3/gadget.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dfe40159eec6ca63b40133bfa783eee2e3ed829f", "status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "versionType": "git"}, {"lessThan": "5a1a847d841505dba2bd85602daf5c218e1d85b8", "status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "versionType": "git"}, {"lessThan": "84c95dbf5bece56086cdb65a64162af35158bdd9", "status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "versionType": "git"}, {"lessThan": "f49697dfba2915a9ff36f94604eb76fa61413929", "status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "versionType": "git"}, {"lessThan": "db27482b9db340402e05d4e9b75352bbaca51af2", "status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "versionType": "git"}, {"lessThan": "45eae113dccaf8e502090ecf5b3d9e9b805add6f", "status": "affected", "version": "72246da40f3719af3bfd104a2365b32537c27d83", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/dwc3/ep0.c", "drivers/usb/dwc3/gadget.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.190", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.149", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.103", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.44", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC CN 4100", "vendor": "Siemens", "versions": [{"lessThan": "V5.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F47280F2-824C-4F32-9522-BEC57DD4A405", "versionEndExcluding": "5.15.190", "versionStartIncluding": "3.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8", "versionEndExcluding": "6.1.149", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48", "versionEndExcluding": "6.6.103", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "12351F24-1133-4775-960C-F2B47E81298B", "versionEndExcluding": "6.12.44", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when 'panic_on_warn' is enabled\nand unnecessary call trace prints when 'panic_on_warn' is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n =======\n->dwc3_thread_interrupt\n ->dwc3_ep0_interrupt\n ->configfs_composite_setup\n ->composite_setup\n ->usb_ep_queue\n ->dwc3_gadget_ep0_queue\n ->__dwc3_gadget_ep0_queue\n ->__dwc3_ep0_do_control_data\n ->dwc3_send_gadget_ep_cmd\n\n2. Disconnect\n ==========\n->dwc3_thread_interrupt\n ->dwc3_gadget_disconnect_interrupt\n ->dwc3_ep0_reset_state\n ->dwc3_ep0_end_control_data\n ->dwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: dwc3: Eliminar WARN_ON para los tiempos de espera de comandos de punto final de dispositivo\n\nEsta confirmaci\u00f3n aborda un tiempo de espera de comando de punto final raramente observado que causa p\u00e1nico del kernel debido a una advertencia cuando 'panic_on_warn' est\u00e1 habilitado y rastreos de llamadas innecesarios cuando 'panic_on_warn' est\u00e1 deshabilitado. Se observa durante casos de prueba de conexi\u00f3n/desconexi\u00f3n r\u00e1pidos controlados por software. El siguiente es uno de esos tiempos de espera de comandos de punto final que observamos:\n\n1. Conectar\n =======\n->dwc3_thread_interrupt\n ->dwc3_ep0_interrupt\n ->configfs_composite_setup\n ->composite_setup\n ->usb_ep_queue\n ->dwc3_gadget_ep0_queue\n ->__dwc3_gadget_ep0_queue\n ->__dwc3_ep0_do_control_data\n ->dwc3_send_gadget_ep_cmd\n\n2. Desconectar\n ==========\n->dwc3_thread_interrupt\n ->dwc3_gadget_disconnect_interrupt\n ->dwc3_ep0_reset_state\n ->dwc3_ep0_end_control_data\n ->dwc3_send_gadget_ep_cmd\n\nEn el escenario del problema, en plataformas Exynos, observamos que las transferencias de control para la conexi\u00f3n anterior a\u00fan no se han completado y el comando de finalizaci\u00f3n de transferencia enviado como parte de la secuencia de desconexi\u00f3n y el procesamiento de la solicitud de caracter\u00edstica USB_ENDPOINT_HALT del host agotan el tiempo de espera. Este podr\u00eda ser un escenario esperado ya que el controlador est\u00e1 procesando comandos de EP enviados como parte de la conexi\u00f3n anterior. Podr\u00eda ser mejor eliminar WARN_ON en todos los lugares donde se env\u00edan comandos de punto final de dispositivo para evitar p\u00e1nicos del kernel innecesarios debido a una advertencia."}], "id": "CVE-2025-39801", "lastModified": "2026-11-05T22:17:32.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39801", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:11:47.846641Z", "version": "2.0.3"}}]}, "published": "2025-09-15T13:15:35.580", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: dwc3: Remove WARN_ON for device endpoint command timeouts", "id": "2395197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395197"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39801", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39801\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39801\nhttps://lore.kernel.org/linux-cve-announce/2025091551-CVE-2025-39801-00f9@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-09-17T10:08:27.210706+00:00", "updated": "2025-09-17T10:08:27.210781+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}