In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: Remove WARN_ON for device endpoint command timeouts

This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when panic_on_warn is enabled and unnecessary call trace prints when panic_on_warn is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed:

1. Connect

->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd

2. Disconnect

->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd

In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.

Weakness

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Affected Software

Extended Description

While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.

Potential Mitigations

References

• https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f
• https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8
• https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9
• https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2
• https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f
• https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html