CVE-2025-40092
- Source
- https://cve.org/CVERecord?id=CVE-2025-40092
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40092.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40092
- Downstream
- Related
- Published
- 2025-10-30T09:47:59.910Z
- Modified
- 2026-03-12T03:54:32.362196Z
- Summary
- usb: gadget: f_ncm: Refactor bind path to use __free()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_ncm: Refactor bind path to use __free()
After an bind/unbind cycle, the ncm->notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->freerequest.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usbepfreerequest+0x2c/0xec ncmbind+0x39c/0x3dc usbaddfunction+0xcc/0x1f0 configfscompositebind+0x468/0x588 gadgetbinddriver+0x104/0x270 really_probe+0x190/0x374 __driverprobedevice+0xa0/0x12c driverprobedevice+0x3c/0x218 __deviceattachdriver+0x14c/0x188 bus_foreachdrv+0x10c/0x168 __deviceattach+0xfc/0x198 deviceinitialprobe+0x14/0x24 busprobedevice+0x94/0x11c deviceadd+0x268/0x48c usbaddgadget+0x198/0x28c dwc3gadgetinit+0x700/0x858 _dwc3setmode+0x3cc/0x664 processscheduledworks+0x1d8/0x488 workerthread+0x244/0x334 kthread+0x114/0x1bc retfromfork+0x10/0x20
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40092.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/185193a4714aa9c78437a7a1858fbe5771f0f45c
- https://git.kernel.org/stable/c/1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2
- https://git.kernel.org/stable/c/75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef
- https://git.kernel.org/stable/c/d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee
- https://git.kernel.org/stable/c/ed78f4d6079d872432b1ed54f155ef61965d3137
- https://git.kernel.org/stable/c/f37de8dec6a4c379b4b8486003a1de00ff8cff3b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40092.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40092
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9f6ce4240a2bf456402c15c06768059e5973f28cFixed185193a4714aa9c78437a7a1858fbe5771f0f45cFixedf37de8dec6a4c379b4b8486003a1de00ff8cff3bFixed1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2Fixedd3fe7143928d8dfa2ec7bac9f906b48bc75b98eeFixeded78f4d6079d872432b1ed54f155ef61965d3137Fixed75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef