CVE-2025-40092

Vulnerability

Description

The vulnerability resides in the USB gadget f_ncm driver in the Linux kernel. After completing a bind/unbind cycle, the ncm->notify_req pointer remains stale. If a subsequent bind operation fails, the error handling path attempts to free this stale request, resulting in a NULL pointer dereference when accessing ep->ops->free_request. This manifests as a kernel panic with a crash trace indicating usb_ep_free_request as the faulting function.

Exploitation

Conditions

To trigger the issue, an attacker must be able to perform a bind/unbind cycle on the USB gadget subsystem and then cause a bind failure. This requires access to the gadget configuration interface (e.g., configfs) and the ability to induce a failure, such as by exhausting resources or providing invalid parameters. No authentication beyond local access is required, but the attacker must have the capability to interact with the USB gadget system.

Impact

Successful exploitation leads to a kernel NULL pointer dereference, which causes a system crash (denial of service). There is no indication of memory corruption or arbitrary code execution; the impact is limited to availability.

Mitigation

Patches are available in the stable kernel trees via commits [1], [2], and [3]. Users should update their Linux kernel to a version containing these fixes. No workarounds have been identified beyond applying the patch.