CVE-2025-38555

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38555
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38555.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38555
Downstream
Related
Published
2025-08-19T17:02:34.110Z
Modified
2026-03-20T12:42:55.128489Z
Summary
usb: gadget : fix use-after-free in composite_dev_cleanup()
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget : fix use-after-free in compositedevcleanup()

  1. In func configfscompositebind() -> compositeosdescreqprepare(): if kmalloc fails, the pointer cdev->osdescreq will be freed but not set to NULL. Then it will return a failure to the upper-level function.
  2. in func configfscompositebind() -> compositedevcleanup(): it will checks whether cdev->osdescreq is NULL. If it is not NULL, it will attempt to use it.This will lead to a use-after-free issue.

BUG: KASAN: use-after-free in compositedevcleanup+0xf4/0x2c0 Read of size 8 at addr 0000004827837a00 by task init/1

CPU: 10 PID: 1 Comm: init Tainted: G O 5.10.97-oh #1 kasan_report+0x188/0x1cc _asanload8+0xb4/0xbc compositedevcleanup+0xf4/0x2c0 configfscompositebind+0x210/0x7ac udcbindtodriver+0xb4/0x1ec usbgadgetprobedriver+0xec/0x21c gadgetdevdescUDCstore+0x264/0x27c

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38555.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
37a3a533429ef9b3cc9f15a656c19623f0e88df7
Fixed
dba96dfa5a0f685b959dd28a52ac8dab0b805204
Fixed
2db29235e900a084a656dea7e0939b0abb7bb897
Fixed
8afb22aa063f706f3343707cdfb8cda4d021dd33
Fixed
e624bf26127645a2f7821e73fdf6dc64bad07835
Fixed
aada327a9f8028c573636fa60c0abc80fb8135c9
Fixed
5f06ee9f9a3665d43133f125c17e5258a13f3963
Fixed
bd3c4ef60baf7f65c963f3e12d9d7b2b091e20ba
Fixed
e1be1f380c82a69f80c68c96a7cfe8759fb30355
Fixed
151c0aa896c47a4459e07fee7d4843f44c1bb18e

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38555.json"