CVE-2025-21838

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: core: flush gadget workqueue after device removal<br /> <br /> device_del() can lead to new work being scheduled in gadget-&gt;work<br /> workqueue. This is observed, for example, with the dwc3 driver with the<br /> following call stack:<br /> device_del()<br /> gadget_unbind_driver()<br /> usb_gadget_disconnect_locked()<br /> dwc3_gadget_pullup()<br /> dwc3_gadget_soft_disconnect()<br /> usb_gadget_set_state()<br /> schedule_work(&amp;gadget-&gt;work)<br /> <br /> Move flush_work() after device_del() to ensure the workqueue is cleaned<br /> up.