CVE-2025-21859
Medium
Description
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: f_midi: f_midi_complete to call queue_work When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to f_midi_transmit, causing a deadlock. Fix it by using queue_work() to schedule the inner f_midi_transmit() via a high priority work queue from the completion handler.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedMar 12, 2025
First seenMar 12, 2025
Weakness typeCWE-667CWE-667
How to fix
Update
- linux linux_kernel6.1.130, 6.6.80, 6.12.17, 6.13.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.2 ≤ v < 6.1.130, 6.2 ≤ v < 6.6.80, 6.7 ≤ v < 6.12.17, 6.13 ≤ v < 6.13.5, 6.14 | 6.1.130, 6.6.80, 6.12.17, 6.13.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.