CVE-2025-40093

Vulnerability

The vulnerability resides in the Linux kernel's USB gadget f_ecm driver. During a bind/unbind cycle, the ecm->notify_req pointer is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request [1].

Exploitation

Exploitation requires local access to trigger USB gadget bind/unbind cycles. An attacker with the ability to manipulate USB gadget configuration, such as via sysfs or certain user-space interactions, can cause the system to crash [1][2].

Impact

The impact is a denial of service (system crash) due to the NULL pointer dereference. There is no indication of privilege escalation or data corruption.

Mitigation

The fix refactors the error handling in the bind path to use the __free() automatic cleanup mechanism, preventing the use-after-free condition. Patches have been applied to the Linux kernel stable branches as seen in references [1] and [2]. Users are advised to update to the latest kernel versions.