CVE-2025-38376 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume Shawn and John reported a hang issue during system suspend as below: - USB gadget is enabled as Ethernet - There is data transfer over USB Ethernet (scp a big file between host and device) - Device is going in/out suspend (echo mem > /sys/power/state) The root cause is the USB device controller is suspended but the USB bus is still active which caused the USB host continues to transfer data with device and the device continues to queue USB requests (in this case, a delayed TCP ACK packet trigger the issue) after controller is suspended, however the USB controller clock is already gated off. Then if udc driver access registers after that point, the system will hang. The correct way to avoid such issue is to disconnect device from host when the USB bus is not at suspend state. Then the host will receive disconnect event and stop data transfer in time. To continue make USB gadget device work after system resume, this will reconnect device automatically. To make usb wakeup work if USB bus is already at suspend state, this will keep connection for it only when USB device controller has enabled wakeup capability.
A vulnerability in the Linux kernel's Chipidea USB controller can cause the system to hang during suspend and resume cycles. This issue arises when a USB gadget, configured as an Ethernet device, is actively transferring data while the device goes in and out of suspend. The USB device controller suspends, but the USB bus remains active, leading to continued data transfer and queued USB requests. If the USB device controller's clock is turned off, accessing the USB controller's registers can cause the system to hang. The vulnerability affects several versions of the Linux kernel.
The vulnerability has been addressed in the Linux kernel. Users should update to the latest version where this issue has been resolved.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/31a6afbe86e8e9deba9ab53876ec49eafc7fd901 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5fd585fedb79bac2af9976b0fa3ffa354f0cc0bb | kernel.org | Patch |
| https://git.kernel.org/stable/c/937f49be49d6ee696eb5457c21ff89c135c9b5ae | kernel.org | Patch |
| https://git.kernel.org/stable/c/c68a27bbebbdb4e0ccd45d4f0df7111a09ddac24 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.2, < 6.6.97 >= 6.7, < 6.12.37 >= 6.13, < 6.15.6 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 19, 2025 | Initial Analysis | [email protected] |
| Jul 25, 2025 | New CVE Received | kernel.org |