CVE-2025-40094

Vulnerability

Analysis

CVE-2025-40094 describes a NULL pointer dereference in the Linux kernel's USB gadget f_acm driver. After a bind/unbind cycle, the acm->notify_req pointer is left stale but not cleared. If a subsequent bind fails, the error-handling path attempts to free this stale request via usb_ep_free_request, which tries to access ep->ops->free_request on a NULL endpoint pointer, leading to a kernel crash [1].

Exploitation

Conditions

Exploitation requires triggering a bind/unbind cycle on a USB gadget system that uses the f_acm driver. An attacker with local access that can manage USB gadget configurations (or physical USB device manipulation) can cause the bind to fail after an unbind, leading to the crash. No special privileges are needed beyond the ability to load/unload USB gadget configurations, which is typically available to root or users with appropriate capabilities [2].

Impact

Successful exploitation results in a kernel panic, causing a denial of service (DoS). The kernel trace shown includes acm_bind and usb_ep_free_request). The crash may also be leveraged for further exploitation if the stale pointer is controlled, but the vendor description focuses on the immediate crash. There is no indication of remote exploitation or data breach [3].

Mitigation

Status

The fix is already merged into the upstream Linux kernel, refactoring the error handling to use the __free() automatic cleanup mechanism, which prevents the stale request from being freed improperly [1]. Users should apply the stable kernel updates containing commit c4301e4dd6b3 or equivalent. No workaround is provided; the safest mitigation is to patch the kernel.