Homepage

CVE-2025-68287 The advisory has been revoked - it doesn't affect any version of package libperf  (opens in a new tab)

Threat Intelligence

EPSS
0.08% (23rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-LIBPERF-15038048
  • published20 Jan 2026
  • disclosed19 Jan 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Jan 2026

CVE-2025-68287  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libperf package and not the libperf package as distributed by AlmaLinux.

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking dwc3_remove_requests(), leading to premature freeing of USB requests and subsequent crashes.

Three distinct execution paths interact with dwc3_remove_requests(): Path 1: Triggered via dwc3_gadget_reset_interrupt() during USB reset handling. The call stack includes:

  • dwc3_ep0_reset_state()
  • dwc3_ep0_stall_and_restart()
  • dwc3_ep0_out_start()
  • dwc3_remove_requests()
  • dwc3_gadget_del_and_unmap_request()

Path 2: Also initiated from dwc3_gadget_reset_interrupt(), but through dwc3_stop_active_transfers(). The call stack includes:

  • dwc3_stop_active_transfers()
  • dwc3_remove_requests()
  • dwc3_gadget_del_and_unmap_request()

Path 3: Occurs independently during adb root execution, which triggers USB function unbind and bind operations. The sequence includes:

  • gserial_disconnect()
  • usb_ep_disable()
  • dwc3_gadget_ep_disable()
  • dwc3_remove_requests() with -ESHUTDOWN status

Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions.

To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue.