CVE-2025-21917

usb: renesas_usbhs: Flush the notify_hotplug_work

State: Published
Severity: 5.5 Medium
Published: Apr 1, 2025
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: renesas_usbhs: Flush the notify_hotplug_work

When performing continuous unbind/bind operations on the USB drivers available on the Renesas RZ/G2L SoC, a kernel crash with the message "Unable to handle kernel NULL pointer dereference at virtual address" may occur. This issue points to the usbhsc_notify_hotplug() function.

Flush the delayed work to avoid its execution when driver resources are unavailable.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	bc57381e634782009b1cb2e86b18013699ada576 to before 4cd847a7b630a85493d0294ad9542c21aafaa246Affected bc57381e634782009b1cb2e86b18013699ada576 to before 394965f90454d6f00fe11879142b720c6c1a872eAffected bc57381e634782009b1cb2e86b18013699ada576 to before 3248c1f833f924246cb98ce7da4569133c1b2292Affected bc57381e634782009b1cb2e86b18013699ada576 to before 4ca078084cdd5f32d533311d6a0b63a60dcadd41Affected bc57381e634782009b1cb2e86b18013699ada576 to before d50f5c0cd949593eb9a3d822b34d7b50046a06b7Affected bc57381e634782009b1cb2e86b18013699ada576 to before e5aac1c9b2974636db7ce796ffa6de88fa08335eAffected bc57381e634782009b1cb2e86b18013699ada576 to before 830818c8e70c0364e377f0c243b28061ef7967ebAffected bc57381e634782009b1cb2e86b18013699ada576 to before 552ca6b87e3778f3dd5b87842f95138162e16c82Affected
LinuxLinux	3.0Affected before 3.0Not affected 5.4.291 through 5.4.Not affected 5.10.235 through 5.10.Not affected 5.15.179 through 5.15.Not affected 6.1.131 through 6.1.Not affected 6.6.83 through 6.6.Not affected 6.12.19 through 6.12.Not affected 6.13.7 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

bc57381e634782009b1cb2e86b18013699ada576 to before 4cd847a7b630a85493d0294ad9542c21aafaa246Affected
bc57381e634782009b1cb2e86b18013699ada576 to before 394965f90454d6f00fe11879142b720c6c1a872eAffected
bc57381e634782009b1cb2e86b18013699ada576 to before 3248c1f833f924246cb98ce7da4569133c1b2292Affected
bc57381e634782009b1cb2e86b18013699ada576 to before 4ca078084cdd5f32d533311d6a0b63a60dcadd41Affected
bc57381e634782009b1cb2e86b18013699ada576 to before d50f5c0cd949593eb9a3d822b34d7b50046a06b7Affected
bc57381e634782009b1cb2e86b18013699ada576 to before e5aac1c9b2974636db7ce796ffa6de88fa08335eAffected
bc57381e634782009b1cb2e86b18013699ada576 to before 830818c8e70c0364e377f0c243b28061ef7967ebAffected
bc57381e634782009b1cb2e86b18013699ada576 to before 552ca6b87e3778f3dd5b87842f95138162e16c82Affected

LinuxLinux

3.0Affected
before 3.0Not affected
5.4.291 through 5.4.*Not affected
5.10.235 through 5.10.*Not affected
5.15.179 through 5.15.*Not affected
6.1.131 through 6.1.*Not affected
6.6.83 through 6.6.*Not affected
6.12.19 through 6.12.*Not affected
6.13.7 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.