{"id":"CVE-2025-39801","summary":"usb: dwc3: Remove WARN_ON for device endpoint command timeouts","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when 'panic_on_warn' is enabled\nand unnecessary call trace prints when 'panic_on_warn' is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n   =======\n-\u003edwc3_thread_interrupt\n -\u003edwc3_ep0_interrupt\n  -\u003econfigfs_composite_setup\n   -\u003ecomposite_setup\n    -\u003eusb_ep_queue\n     -\u003edwc3_gadget_ep0_queue\n      -\u003e__dwc3_gadget_ep0_queue\n       -\u003e__dwc3_ep0_do_control_data\n        -\u003edwc3_send_gadget_ep_cmd\n\n2. Disconnect\n   ==========\n-\u003edwc3_thread_interrupt\n -\u003edwc3_gadget_disconnect_interrupt\n  -\u003edwc3_ep0_reset_state\n   -\u003edwc3_ep0_end_control_data\n    -\u003edwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn.","modified":"2026-04-02T12:48:10.055524Z","published":"2025-09-15T12:36:43.936Z","related":["SUSE-SU-2025:03600-1","SUSE-SU-2025:03634-1","SUSE-SU-2025:20851-1","SUSE-SU-2025:20861-1","SUSE-SU-2025:20870-1","SUSE-SU-2025:20898-1","SUSE-SU-2025:21074-1","SUSE-SU-2025:21139-1","SUSE-SU-2025:21179-1","SUSE-SU-2025:3751-1","SUSE-SU-2025:4057-1","SUSE-SU-2025:4132-1","SUSE-SU-2025:4141-1","openSUSE-SU-2025:20081-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39801.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39801.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39801"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"72246da40f3719af3bfd104a2365b32537c27d83"},{"fixed":"dfe40159eec6ca63b40133bfa783eee2e3ed829f"},{"fixed":"5a1a847d841505dba2bd85602daf5c218e1d85b8"},{"fixed":"84c95dbf5bece56086cdb65a64162af35158bdd9"},{"fixed":"f49697dfba2915a9ff36f94604eb76fa61413929"},{"fixed":"db27482b9db340402e05d4e9b75352bbaca51af2"},{"fixed":"45eae113dccaf8e502090ecf5b3d9e9b805add6f"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39801.json"}}],"schema_version":"1.7.5"}