CVE-2025-68312

Description

In the Linux kernel, the following vulnerability has been resolved: usbnet: Prevents free active kevent The root cause of this issue are: 1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here. 2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed. The solution to this problem is to cancel the kevent before executing free_netdev().

Is your site exposed to CVE-2025-68312?

Run a free security scan — no signup, results in seconds.

References

Other References

https://git.kernel.org/stable/c/285d4b953f2ca03c358f986718dd89ee9bde632e https://git.kernel.org/stable/c/2ce1de32e05445d77fc056f6ff8339cfb78a5f84 https://git.kernel.org/stable/c/3a10619fdefd3051aeb14860e4d4335529b4e94d https://git.kernel.org/stable/c/420c84c330d1688b8c764479e5738bbdbf0a33de https://git.kernel.org/stable/c/43005002b60ef3424719ecda16d124714b45da3b https://git.kernel.org/stable/c/5158fb8da162e3982940f30cd01ed77bdf42c6fc https://git.kernel.org/stable/c/88a38b135d69f5db9024ff6527232f1b51be8915 https://git.kernel.org/stable/c/9a579d6a39513069d298eee70770bbac8a148565

Frequently Asked Questions

What is CVE-2025-68312? +

In the Linux kernel, the following vulnerability has been resolved: usbnet: Prevents free active kevent The root cause of this issue are: 1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here. 2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed. The solution to this problem is to cancel the kevent before executing free_netdev().

How do I check if I'm vulnerable to CVE-2025-68312? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2025-68312

Description

References

Other References

Frequently Asked Questions

Don't wait for an exploit