In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: fmidi: fmidicomplete to call queuework
When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to fmiditransmit, causing a deadlock.
Fix it by using queuework() to schedule the inner fmidi_transmit() via a high priority work queue from the completion handler.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21859.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21859.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/function/f_midi.c",
"function": "f_midi_complete"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09957657d7767d164b3432af2129bd72947553c",
"deprecated": false,
"digest": {
"function_hash": "297670611895830534403129150213426761825",
"length": 976.0
},
"id": "CVE-2025-21859-2b6f426a",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/function/f_midi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09957657d7767d164b3432af2129bd72947553c",
"deprecated": false,
"digest": {
"line_hashes": [
"195802286281642416687709827191412505052",
"46241497053032832329028180620447505959",
"114966004430204083518878950732199769523",
"4286888052090196711795454071797677845"
],
"threshold": 0.9
},
"id": "CVE-2025-21859-92960674",
"signature_type": "Line"
}
]