Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability (CVE-2025-22050)

A security vulnerability in the Linux kernel’s USB networking subsystem could allow a locally present attacker to trigger a kernel panic on affected systems.

Tracked as CVE-2025-22050, the flaw affects the kernel’s usbnet driver and is caused by a race condition involving USB network device request processing. The vulnerability was publicly disclosed on 16 April 2025 and has been classified as a medium-severity issue.

What is CVE-2025-22050?

The vulnerability is described as a missing usbnet_going_away check in a critical part of the USB networking code.

The problem occurs because usb_submit_urb() does not perform the same usbnet_going_away validation that is performed by __usbnet_queue_skb(). Under certain conditions, this can result in a USB Request Block (URB) being successfully submitted while the associated socket buffer (SKB) is not correctly queued.

The Linux kernel can subsequently attempt to operate on an invalid or unexpected SKB. This can result in a NULL pointer dereference and ultimately a kernel panic.

The affected code is located in:

drivers/net/usb/usbnet.c

Which Linux kernels are affected?

The issue was introduced into the Linux kernel during development of the 6.x series. The Linux kernel CVE announcement states that the problem was introduced in kernel 6.12, with related changes also being backported into earlier kernel branches including 6.10 and 6.11.

The vulnerability was fixed upstream in Linux 6.15-rc1.

Because the fix has subsequently been backported to supported stable kernel branches, the precise versions affected depend on the Linux distribution and kernel package being used.

For example, Ubuntu lists fixes for several releases, including Ubuntu 25.04, 24.10 and Ubuntu 24.04 LTS. Ubuntu 24.04 LTS received the fix in kernel package 6.8.0-86.87.

Security impact

The primary impact of CVE-2025-22050 is availability.

A successful attack can cause the Linux kernel to crash, potentially resulting in a denial-of-service condition. The upstream description specifically identifies the problem as a NULL pointer dereference leading to a kernel panic.

The vulnerability has also been classified under CWE-476, which covers NULL Pointer Dereference vulnerabilities.

Current vulnerability information indicates a CVSS v3.1 score of 4.7, placing it in the medium-severity category. The score reflects the requirement for local access and privileges, as well as the relatively high attack complexity.

There is an important distinction here: CVE-2025-22050 is not simply a remote internet-based vulnerability that can be exploited against any Linux machine. An attacker needs local access and the appropriate conditions to trigger the underlying race condition.

Could it lead to privilege escalation?

There has been additional security research around the flaw. A September 2026 vulnerability analysis associated with ZDI describes CVE-2025-22050 as a Linux kernel usbnet driver race-condition vulnerability and reports a potential privilege-escalation impact.

However, the original Linux kernel advisory describes the immediate consequence as a NULL pointer dereference and kernel panic. Organisations should therefore rely on their Linux distribution’s current security advisory and patched kernel versions when assessing the practical risk to their systems.

Users should install the latest kernel updates

Linux administrators should check whether their distribution has issued an update addressing CVE-2025-22050 and install the latest supported kernel package.

Ubuntu, Debian and SUSE have all published information or fixes relating to the vulnerability. Debian’s security tracker, for example, identifies the issue as affecting the Linux kernel and provides distribution-specific update information.

The upstream Linux kernel security announcement also recommends updating to the latest supported kernel version.

CVE records are maintained as the status of vulnerabilities changes, so administrators should check their distribution’s security tracker rather than relying solely on the original CVE publication.

What should administrators do?

Administrators running Linux systems should:

• Check the installed kernel version.
• Determine whether the distribution has backported the CVE-2025-22050 fix.
• Install the latest available security updates.
• Reboot systems where required so that the patched kernel is actually running.
• Pay particular attention to systems using USB networking hardware.
• Continue monitoring vendor security advisories for additional updates.

The vulnerability is particularly relevant to Linux systems that make use of USB network adapters or other hardware handled through the kernel’s usbnet subsystem.

CVE-2025-22050 was disclosed in April 2025, but updates to vulnerability records and vendor information have continued. The CVE record remains an important reference point for tracking affected configurations and subsequent fixes.