Kernel Panic Risk in Linux Package Due to USB Command Timeout
Summary
CVE-2025-39801: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel pani... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used across various distributions, including Debian 11, 12, 13, and 14. This package is critical for system stability and performance, but it is vulnerable to specific issues that can lead to kernel panics under certain conditions.
Vulnerability Detail
The vulnerability identified as CVE-2025-39801 arises from a command timeout in the USB subsystem of the Linux kernel, specifically within the dwc3 driver. When 'panic_on_warn' is enabled, this timeout can trigger a kernel panic, leading to system instability. The issue is particularly evident during rapid connect/disconnect scenarios, where control transfers may not complete before new commands are issued, resulting in unexpected behavior and potential crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the 'panic_on_warn' setting in the kernel configuration to prevent kernel panics from occurring due to this warning. This can be done by modifying the kernel boot parameters or adjusting the sysctl settings accordingly.
Conclusion
CVE-2025-39801 presents a significant risk to systems using the Linux kernel, particularly in scenarios involving USB device management. Users are encouraged to apply the available patches and consider workarounds to mitigate the risk of kernel panics. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39801 is a vulnerability in the Linux kernel related to USB command timeouts that can lead to kernel panics.
This vulnerability can cause your system to become unstable and crash during specific USB operations, particularly when connecting and disconnecting devices rapidly.
Yes, a patch is available in the latest versions of the Linux package for Debian. Users should update their systems to the patched version.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
