CVE-2025-39801 – This CVE addresses a kernel panic vulnerability... (How to Fix)

Q: What is the severity of CVE-2025-39801?

CVE-2025-39801 has a CVSS score of 5.5 (MEDIUM). This CVE addresses a kernel panic vulnerability in the Linux kernel's USB DWC3 driver. When 'panic_on_warn' is enabled, endpoint command timeouts during rapid USB connect/disconnect sequences trigger a WARN_ON that causes kernel panic. This affects Linux systems using the DWC3 USB controller, particularly Exynos platforms.

📋 TL;DR

This CVE addresses a kernel panic vulnerability in the Linux kernel's USB DWC3 driver. When 'panic_on_warn' is enabled, endpoint command timeouts during rapid USB connect/disconnect sequences trigger a WARN_ON that causes kernel panic. This affects Linux systems using the DWC3 USB controller, particularly Exynos platforms.

💻 Affected Systems

Products:

Linux kernel with DWC3 USB driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Primarily affects systems with Exynos platforms and DWC3 USB controllers. Requires 'panic_on_warn' enabled for kernel panic scenario.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, requiring physical or remote reboot.

🟠

Likely Case

System instability or crash during USB device hotplug operations, particularly with fast connect/disconnect cycles.

🟢

If Mitigated

Minor performance impact or dropped USB connections without system crash.

🌐 Internet-Facing: LOW - Requires physical USB access or USB-over-IP with specific timing conditions.

🏢 Internal Only: MEDIUM - Could be triggered by users with physical USB access or USB device management operations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires specific timing conditions during USB connect/disconnect operations and depends on system configuration.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 45eae113dccaf8e502090ecf5b3d9e9b805add6f or later

Vendor Advisory: https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable panic_on_warn

all

Prevent kernel panic by disabling panic_on_warn sysctl parameter

echo 0 > /proc/sys/kernel/panic_on_warn
sysctl -w kernel.panic_on_warn=0

Avoid rapid USB connect/disconnect

all

Implement USB device management policies to prevent rapid connect/disconnect cycles

🧯 If You Can't Patch

Disable panic_on_warn sysctl parameter
Restrict physical USB access to trusted users only
Monitor system logs for WARN messages related to DWC3 endpoint timeouts

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if DWC3 driver is loaded: 'uname -r' and 'lsmod | grep dwc3'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or check that panic_on_warn is disabled

📡 Detection & Monitoring

Log Indicators:

Kernel WARN messages mentioning DWC3 endpoint command timeouts
Kernel panic logs when panic_on_warn is enabled

Network Indicators:

USB device connection instability

SIEM Query:

source="kernel" AND ("WARN" AND "dwc3" AND "endpoint" AND "timeout") OR ("panic" AND "dwc3")

📊 Metadata

CVE ID: CVE-2025-39801

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-617

EPSS Score: 0.01% exploit probability (0.8th percentile)

Published: September 15, 2025

Last Updated: January 23, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-39801, you might also want to check these: