usb: dwc3: fix fault at system suspend if device was already runtime suspended (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 15 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix fault at system suspend if device was already runtime suspended If the device was already runtime suspended then during system suspend we cannot access the device registers else it will crash. Also we cannot access any registers after dwc3_core_exit() on some platforms so move the dwc3_enable_susphy() call to the top.
References
- https://git.kernel.org/stable/c/d9e65d461a9de037e7c9d584776d025cfce6d86d
- https://git.kernel.org/stable/c/562804b1561cc248cc37746a1c96c83cab1d7209
- https://git.kernel.org/stable/c/4abc5ee334fe4aba50461c45fdaaa4c5e5c57789
- https://git.kernel.org/stable/c/06b98197b69e2f2af9cb1991ee0b1c876edf7b86
- https://git.kernel.org/stable/c/9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2024-50486
- GCVE · GCVE-0-2024-53070
CERT-FR advisories
- CERTFR-2026-AVI-0369 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0247 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0225 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0170 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1057 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1031 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.170 < 5.15.172cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.115 < 6.1.117cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.59 < 6.6.61cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.11.5 < 6.11.8
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 073530898ebf44a9418434e899cfa9ca86945333 < d9e65d461a9de037e7c9d584776d025cfce6d86d ; affected 85ca88f93162acb94dbcb26d0ee2b145864d14a1 < 562804b1561cc248cc37746a1c96c83cab1d7209 ; affected 4fad7370086797afe6471493e3a5f36add8c48a7 < 4abc5ee334fe4aba50461c45fdaaa4c5e5c57789 ; affected a690a9e38e6ba819789074388de7cff06425ef5b < 06b98197b69e2f2af9cb1991ee0b1c876edf7b86 ; affected 705e3ce37bccdf2ed6f848356ff355f480d51a91 < 9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b |
| Linux · Linux | affected 5.15.170 < 5.15.172 ; affected 6.1.115 < 6.1.117 ; affected 6.6.59 < 6.6.61 ; affected 6.11.5 < 6.11.8 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |