CVE-2025-21859 USB: gadget: f_midi: f_midi_complete to call queue_work
A deadlock in the Linux kernel USB MIDI gadget driver allows local attackers to cause a denial of service via re-entrant locking.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21859?
CVE-2025-21859 is a medium-severity vulnerability in Linux kernel, published on 12 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: f_midi: f_midi_complete to call queue_work
When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to f_midi_transmit, causing a deadlock.
Fix it by using queue_work() to schedule the inner f_midi_transmit() via a high priority work queue from the completion handler.
Weakness: CWE-667
Which versions are affected by CVE-2025-21859?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21859?
Apply the vendor's patch.
Is CVE-2025-21859 being exploited?
There is no known exploitation of CVE-2025-21859 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-58493, AZL-58572, BELL-CVE-2025-21859, DEBIAN-CVE-2025-21859, GHSA-r5hj-8p6x-9rq8, ROOT-OS-UBUNTU-2404-CVE-2025-21859 and 1 more.