{"id":"CVE-2025-39801","title":"usb: dwc3: Remove WARN_ON for device endpoint command timeouts","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn w…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < dfe40159eec6ca63b40133bfa783eee2e3ed829f","Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < 5a1a847d841505dba2bd85602daf5c218e1d85b8","Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < 84c95dbf5bece56086cdb65a64162af35158bdd9","Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < f49697dfba2915a9ff36f94604eb76fa61413929","Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < db27482b9db340402e05d4e9b75352bbaca51af2","Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < 45eae113dccaf8e502090ecf5b3d9e9b805add6f","Linux 3.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:11:47.846641Z"},"published":"2025-09-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:12:58.732Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39801","references":[{"url":"https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f"},{"url":"https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8"},{"url":"https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9"},{"url":"https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929"},{"url":"https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2"},{"url":"https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f"}],"tags":["cve.org"],"epss":0.00153,"epssPercentile":0.0447,"ingestedAt":"2026-11-05T22:38:32.029Z","slug":"CVE-2025-39801","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when 'panic_on_warn' is enabled\nand unnecessary call trace prints when 'panic_on_warn' is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n   =======\n->dwc3_thread_interrupt\n ->dwc3_ep0_interrupt\n  ->configfs_composite_setup\n   ->composite_setup\n    ->usb_ep_queue\n     ->dwc3_gadget_ep0_queue\n      ->__dwc3_gadget_ep0_queue\n       ->__dwc3_ep0_do_control_data\n        ->dwc3_send_gadget_ep_cmd\n\n2. Disconnect\n   ==========\n->dwc3_thread_interrupt\n ->dwc3_gadget_disconnect_interrupt\n  ->dwc3_ep0_reset_state\n   ->dwc3_ep0_end_control_data\n    ->dwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn.\n\n## Affected\n\n- `Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < dfe40159eec6ca63b40133bfa783eee2e3ed829f`\n- `Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < 5a1a847d841505dba2bd85602daf5c218e1d85b8`\n- `Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < 84c95dbf5bece56086cdb65a64162af35158bdd9`\n- `Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < f49697dfba2915a9ff36f94604eb76fa61413929`\n- `Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < db27482b9db340402e05d4e9b75352bbaca51af2`\n- `Linux >= 72246da40f3719af3bfd104a2365b32537c27d83 < 45eae113dccaf8e502090ecf5b3d9e9b805add6f`\n- `Linux 3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}