In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: facm: Refactor bind path to use _free()
After an bind/unbind cycle, the acm->notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->freerequest.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usbepfreerequest+0x2c/0xec gsfreereq+0x30/0x44 acmbind+0x1b8/0x1f4 usbaddfunction+0xcc/0x1f0 configfscompositebind+0x468/0x588 gadgetbinddriver+0x104/0x270 reallyprobe+0x190/0x374 _driverprobedevice+0xa0/0x12c driverprobedevice+0x3c/0x218 _deviceattachdriver+0x14c/0x188 busforeachdrv+0x10c/0x168 _deviceattach+0xfc/0x198 deviceinitialprobe+0x14/0x24 busprobedevice+0x94/0x11c deviceadd+0x268/0x48c usbaddgadget+0x198/0x28c dwc3gadgetinit+0x700/0x858 _dwc3setmode+0x3cc/0x664 processscheduledworks+0x1d8/0x488 workerthread+0x244/0x334 kthread+0x114/0x1bc retfrom_fork+0x10/0x20
[
{
"id": "CVE-2025-40094-25499d63",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "71083487703319743385267054847157293926",
"length": 2446.0
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c",
"function": "acm_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5d116862dd3ed162d079738a5ebddf9fceea850"
},
{
"id": "CVE-2025-40094-2ebc3884",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"136957853545070866518785207686950421353",
"170795001564592293781827443702063583810",
"68043566534733642554371443323933881750",
"169446255793962116285765876393217370374",
"234444320049105180007012143195213719514",
"218921817556203178672520098027173138661",
"81918458287229375278886898673299828257",
"155829644090705758748960716660293080984",
"271047979142437106290016691948619195528",
"33113928675253032016080551476821942442",
"321238309046391787379230739470030388871",
"58518082084117035580586559501312829509",
"209522924368043952667891055203507449885",
"266179206168303545947941700357856905042",
"148591397512869547583764178266869201836",
"103587103198768160324176706136777692039",
"322763162809886976904715654969834159690",
"10798306519689641714643588494987597920",
"308836038630245633832631679081674390514",
"176665326075471242023543027150541611569",
"201384541432353924892563911795272246833",
"323721347802506258865874641410773348497",
"220311009685752082089937768156377182133",
"326679041777601504711619051782066702048",
"29815556267093440420550178413630828371",
"232246240603832108174423007181702574160",
"262047415957316909457174990326958165999",
"295826761830187706720484381520343909776",
"66348480149371822784571858296080617221",
"41062712395634634760276269978900036052",
"206298780210551047523314264557463359411",
"195634801255544208678195987333169781421",
"221001843371661096926803067695484681358",
"163245725524787762624039920418911763269",
"222652318232303904533645150404344825773",
"156468642921810082298561451975531837850",
"96590464155626860941967028681625855006",
"71266347746089600610180892216861821074",
"43355344779788953763293723154573253705",
"304875103693289458198761570236797101929",
"35656521305927981091024833225898580231",
"271840498081268004081790166562782716786",
"172110138930135975255875139989825120720",
"42483980748480259251302250856751120983",
"65730704891061906763864058167839774980",
"38462766431430987459900754635536717940",
"274824699783691229608904263266334967869",
"127691573679298227344116621824935652353",
"318437441340850971619869305438266040282",
"109041700616259994508341689030082001126",
"306810012481787116946500244327575023532",
"281052165953476290613009744920935787019",
"173825772632234459035438574476176928493",
"248915639252071224150178457862790106384",
"290735566132563522511924820500488352481"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47b2116e54b4a854600341487e8b55249e926324"
},
{
"id": "CVE-2025-40094-5a61099b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"136957853545070866518785207686950421353",
"170795001564592293781827443702063583810",
"68043566534733642554371443323933881750",
"169446255793962116285765876393217370374",
"234444320049105180007012143195213719514",
"218921817556203178672520098027173138661",
"81918458287229375278886898673299828257",
"155829644090705758748960716660293080984",
"271047979142437106290016691948619195528",
"33113928675253032016080551476821942442",
"321238309046391787379230739470030388871",
"58518082084117035580586559501312829509",
"209522924368043952667891055203507449885",
"266179206168303545947941700357856905042",
"148591397512869547583764178266869201836",
"103587103198768160324176706136777692039",
"322763162809886976904715654969834159690",
"10798306519689641714643588494987597920",
"308836038630245633832631679081674390514",
"176665326075471242023543027150541611569",
"201384541432353924892563911795272246833",
"323721347802506258865874641410773348497",
"220311009685752082089937768156377182133",
"326679041777601504711619051782066702048",
"29815556267093440420550178413630828371",
"232246240603832108174423007181702574160",
"262047415957316909457174990326958165999",
"295826761830187706720484381520343909776",
"66348480149371822784571858296080617221",
"41062712395634634760276269978900036052",
"206298780210551047523314264557463359411",
"195634801255544208678195987333169781421",
"221001843371661096926803067695484681358",
"163245725524787762624039920418911763269",
"222652318232303904533645150404344825773",
"156468642921810082298561451975531837850",
"96590464155626860941967028681625855006",
"71266347746089600610180892216861821074",
"43355344779788953763293723154573253705",
"304875103693289458198761570236797101929",
"35656521305927981091024833225898580231",
"271840498081268004081790166562782716786",
"172110138930135975255875139989825120720",
"42483980748480259251302250856751120983",
"65730704891061906763864058167839774980",
"38462766431430987459900754635536717940",
"274824699783691229608904263266334967869",
"127691573679298227344116621824935652353",
"318437441340850971619869305438266040282",
"109041700616259994508341689030082001126",
"306810012481787116946500244327575023532",
"281052165953476290613009744920935787019",
"173825772632234459035438574476176928493",
"248915639252071224150178457862790106384",
"290735566132563522511924820500488352481"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@201a66d8e6630762e760e1d78f1d149da1691e7b"
},
{
"id": "CVE-2025-40094-6dea0ab9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "262978129452329877309261316915233122527",
"length": 2333.0
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c",
"function": "acm_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e348d18fb0124b662cfefb3001733b49da428215"
},
{
"id": "CVE-2025-40094-6ef2427c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "2364394241830736490745778730236647085",
"length": 2480.0
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c",
"function": "acm_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47b2116e54b4a854600341487e8b55249e926324"
},
{
"id": "CVE-2025-40094-73718d96",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "2364394241830736490745778730236647085",
"length": 2480.0
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c",
"function": "acm_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@201a66d8e6630762e760e1d78f1d149da1691e7b"
},
{
"id": "CVE-2025-40094-9590120a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"136957853545070866518785207686950421353",
"170795001564592293781827443702063583810",
"68043566534733642554371443323933881750",
"169446255793962116285765876393217370374",
"234444320049105180007012143195213719514",
"218921817556203178672520098027173138661",
"81918458287229375278886898673299828257",
"155829644090705758748960716660293080984",
"271047979142437106290016691948619195528",
"33113928675253032016080551476821942442",
"321238309046391787379230739470030388871",
"58518082084117035580586559501312829509",
"209522924368043952667891055203507449885",
"266179206168303545947941700357856905042",
"148591397512869547583764178266869201836",
"103587103198768160324176706136777692039",
"322763162809886976904715654969834159690",
"10798306519689641714643588494987597920",
"308836038630245633832631679081674390514",
"176665326075471242023543027150541611569",
"201384541432353924892563911795272246833",
"323721347802506258865874641410773348497",
"220311009685752082089937768156377182133",
"326679041777601504711619051782066702048",
"29815556267093440420550178413630828371",
"232246240603832108174423007181702574160",
"262047415957316909457174990326958165999",
"295826761830187706720484381520343909776",
"66348480149371822784571858296080617221",
"41062712395634634760276269978900036052",
"206298780210551047523314264557463359411",
"148808967339966467983451152444508201885",
"127196310705884031358097425036860521310",
"295518788417483359822038373255255622900",
"96590464155626860941967028681625855006",
"71266347746089600610180892216861821074",
"43355344779788953763293723154573253705",
"304875103693289458198761570236797101929",
"35656521305927981091024833225898580231",
"271840498081268004081790166562782716786",
"172110138930135975255875139989825120720",
"42483980748480259251302250856751120983",
"65730704891061906763864058167839774980",
"38462766431430987459900754635536717940",
"274824699783691229608904263266334967869",
"127691573679298227344116621824935652353",
"318437441340850971619869305438266040282",
"109041700616259994508341689030082001126",
"306810012481787116946500244327575023532",
"281052165953476290613009744920935787019",
"173825772632234459035438574476176928493",
"248915639252071224150178457862790106384",
"290735566132563522511924820500488352481"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e348d18fb0124b662cfefb3001733b49da428215"
},
{
"id": "CVE-2025-40094-9b8612a0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "2364394241830736490745778730236647085",
"length": 2480.0
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c",
"function": "acm_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4301e4dd6b32faccb744f1c2320e64235b68d3b"
},
{
"id": "CVE-2025-40094-a61d5bbe",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"136957853545070866518785207686950421353",
"170795001564592293781827443702063583810",
"68043566534733642554371443323933881750",
"169446255793962116285765876393217370374",
"234444320049105180007012143195213719514",
"218921817556203178672520098027173138661",
"81918458287229375278886898673299828257",
"155829644090705758748960716660293080984",
"271047979142437106290016691948619195528",
"33113928675253032016080551476821942442",
"321238309046391787379230739470030388871",
"58518082084117035580586559501312829509",
"209522924368043952667891055203507449885",
"266179206168303545947941700357856905042",
"148591397512869547583764178266869201836",
"103587103198768160324176706136777692039",
"322763162809886976904715654969834159690",
"10798306519689641714643588494987597920",
"308836038630245633832631679081674390514",
"176665326075471242023543027150541611569",
"201384541432353924892563911795272246833",
"323721347802506258865874641410773348497",
"220311009685752082089937768156377182133",
"326679041777601504711619051782066702048",
"29815556267093440420550178413630828371",
"232246240603832108174423007181702574160",
"262047415957316909457174990326958165999",
"295826761830187706720484381520343909776",
"66348480149371822784571858296080617221",
"41062712395634634760276269978900036052",
"206298780210551047523314264557463359411",
"148808967339966467983451152444508201885",
"127196310705884031358097425036860521310",
"295518788417483359822038373255255622900",
"96590464155626860941967028681625855006",
"71266347746089600610180892216861821074",
"43355344779788953763293723154573253705",
"304875103693289458198761570236797101929",
"35656521305927981091024833225898580231",
"271840498081268004081790166562782716786",
"172110138930135975255875139989825120720",
"42483980748480259251302250856751120983",
"65730704891061906763864058167839774980",
"183703175926971913377649154301344030701",
"109390427443130872542103558373947988050",
"127691573679298227344116621824935652353",
"318437441340850971619869305438266040282",
"109041700616259994508341689030082001126",
"306810012481787116946500244327575023532",
"281052165953476290613009744920935787019",
"173825772632234459035438574476176928493",
"248915639252071224150178457862790106384",
"290735566132563522511924820500488352481"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5d116862dd3ed162d079738a5ebddf9fceea850"
},
{
"id": "CVE-2025-40094-b64d144f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"136957853545070866518785207686950421353",
"170795001564592293781827443702063583810",
"68043566534733642554371443323933881750",
"169446255793962116285765876393217370374",
"234444320049105180007012143195213719514",
"218921817556203178672520098027173138661",
"81918458287229375278886898673299828257",
"155829644090705758748960716660293080984",
"271047979142437106290016691948619195528",
"33113928675253032016080551476821942442",
"321238309046391787379230739470030388871",
"58518082084117035580586559501312829509",
"209522924368043952667891055203507449885",
"266179206168303545947941700357856905042",
"148591397512869547583764178266869201836",
"103587103198768160324176706136777692039",
"322763162809886976904715654969834159690",
"10798306519689641714643588494987597920",
"308836038630245633832631679081674390514",
"176665326075471242023543027150541611569",
"201384541432353924892563911795272246833",
"323721347802506258865874641410773348497",
"220311009685752082089937768156377182133",
"326679041777601504711619051782066702048",
"29815556267093440420550178413630828371",
"232246240603832108174423007181702574160",
"262047415957316909457174990326958165999",
"295826761830187706720484381520343909776",
"66348480149371822784571858296080617221",
"41062712395634634760276269978900036052",
"206298780210551047523314264557463359411",
"148808967339966467983451152444508201885",
"127196310705884031358097425036860521310",
"295518788417483359822038373255255622900",
"96590464155626860941967028681625855006",
"71266347746089600610180892216861821074",
"43355344779788953763293723154573253705",
"304875103693289458198761570236797101929",
"35656521305927981091024833225898580231",
"271840498081268004081790166562782716786",
"172110138930135975255875139989825120720",
"42483980748480259251302250856751120983",
"65730704891061906763864058167839774980",
"183703175926971913377649154301344030701",
"109390427443130872542103558373947988050",
"127691573679298227344116621824935652353",
"318437441340850971619869305438266040282",
"109041700616259994508341689030082001126",
"306810012481787116946500244327575023532",
"281052165953476290613009744920935787019",
"173825772632234459035438574476176928493",
"248915639252071224150178457862790106384",
"290735566132563522511924820500488352481"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b1546f7c5fc6c44555a8e7a2b34229d1dcd2175"
},
{
"id": "CVE-2025-40094-c8d12a5d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "71083487703319743385267054847157293926",
"length": 2446.0
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c",
"function": "acm_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b1546f7c5fc6c44555a8e7a2b34229d1dcd2175"
},
{
"id": "CVE-2025-40094-fdb5f269",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"136957853545070866518785207686950421353",
"170795001564592293781827443702063583810",
"68043566534733642554371443323933881750",
"169446255793962116285765876393217370374",
"234444320049105180007012143195213719514",
"218921817556203178672520098027173138661",
"81918458287229375278886898673299828257",
"155829644090705758748960716660293080984",
"271047979142437106290016691948619195528",
"33113928675253032016080551476821942442",
"321238309046391787379230739470030388871",
"58518082084117035580586559501312829509",
"209522924368043952667891055203507449885",
"266179206168303545947941700357856905042",
"148591397512869547583764178266869201836",
"103587103198768160324176706136777692039",
"322763162809886976904715654969834159690",
"10798306519689641714643588494987597920",
"308836038630245633832631679081674390514",
"176665326075471242023543027150541611569",
"201384541432353924892563911795272246833",
"323721347802506258865874641410773348497",
"220311009685752082089937768156377182133",
"326679041777601504711619051782066702048",
"29815556267093440420550178413630828371",
"232246240603832108174423007181702574160",
"262047415957316909457174990326958165999",
"295826761830187706720484381520343909776",
"66348480149371822784571858296080617221",
"41062712395634634760276269978900036052",
"206298780210551047523314264557463359411",
"195634801255544208678195987333169781421",
"221001843371661096926803067695484681358",
"163245725524787762624039920418911763269",
"222652318232303904533645150404344825773",
"156468642921810082298561451975531837850",
"96590464155626860941967028681625855006",
"71266347746089600610180892216861821074",
"43355344779788953763293723154573253705",
"304875103693289458198761570236797101929",
"35656521305927981091024833225898580231",
"271840498081268004081790166562782716786",
"172110138930135975255875139989825120720",
"42483980748480259251302250856751120983",
"65730704891061906763864058167839774980",
"38462766431430987459900754635536717940",
"274824699783691229608904263266334967869",
"127691573679298227344116621824935652353",
"318437441340850971619869305438266040282",
"109041700616259994508341689030082001126",
"306810012481787116946500244327575023532",
"281052165953476290613009744920935787019",
"173825772632234459035438574476176928493",
"248915639252071224150178457862790106384",
"290735566132563522511924820500488352481"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_acm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4301e4dd6b32faccb744f1c2320e64235b68d3b"
}
]