In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fecm: Refactor bind path to use _free() After an bind/unbind cycle, the ecm->notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->freerequest. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.