CVE-2025-40223

Vulnerability

Description

CVE-2025-40223 is a use-after-free vulnerability in the Linux kernel's MOST (Media Oriented Systems Transport) USB driver. The bug resides in the hdm_disconnect() function, which calls most_deregister_interface(), eventually triggering device_unregister(iface->dev). If that operation drops the last reference, the device core may invoke release_mdev() immediately while hdm_disconnect() is still executing. The old code freed several mdev-owned allocations in hdm_disconnect() and then performed additional put_device() calls, leading to use-after-free or double-free conditions when release_mdev() ran [1][2][3].

Exploitation

An attacker with physical access or ability to trigger device disconnection can exploit this race condition. The vulnerability requires no authentication and can be triggered by unplugging a USB MOST device or causing a disconnect event. The use-after-free occurs in kernel context, making it exploitable but requiring precise timing.

Impact

Successful exploitation could lead to local privilege escalation (LPE) or denial of service (DoS). An attacker able to control the freed memory could potentially execute arbitrary code in kernel space. The vulnerability has been reported by syzbot with KASAN slab-use-after-free reports [1].

Mitigation

The fix moves the freeing of mdev-owned allocations into release_mdev(), ensuring they happen exactly once when the device is truly released, and removes redundant put_device() calls in hdm_disconnect(). Patches are available in the stable kernel trees [1][2][3]. Users should apply the latest stable kernel updates to mitigate this vulnerability.