CVE-2025-68312

A use-after-free vulnerability was found in the Linux kernel's usbnet driver. When a usbnet device is unregistered before a scheduled kevent work item executes, free_netdev() frees memory that the pending kevent will later access. This occurs because kevent cancellation is missing before device cleanup when the device was never brought up.

This race window exists during USB network device probe/disconnect sequences. The timing requirements make exploitation difficult but the underlying UAF could potentially be leveraged for code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.