CVE-2025-38555

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget : fix use-after-free in compositedevcleanup()

1. In func configfscompositebind() -> compositeosdescreqprepare(): if kmalloc fails, the pointer cdev->osdescreq will be freed but not set to NULL. Then it will return a failure to the upper-level function.
2. in func configfscompositebind() -> compositedevcleanup(): it will checks whether cdev->osdescreq is NULL. If it is not NULL, it will attempt to use it.This will lead to a use-after-free issue.

BUG: KASAN: use-after-free in compositedevcleanup+0xf4/0x2c0 Read of size 8 at addr 0000004827837a00 by task init/1

CPU: 10 PID: 1 Comm: init Tainted: G O 5.10.97-oh #1 kasanreport+0x188/0x1cc _asanload8+0xb4/0xbc compositedevcleanup+0xf4/0x2c0 configfscompositebind+0x210/0x7ac udcbindtodriver+0xb4/0x1ec usbgadgetprobedriver+0xec/0x21c gadgetdevdescUDC_store+0x264/0x27c