In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_ncm: Refactor bind path to use __free()
After an bind/unbind cycle, the ncm->notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->freerequest.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usbepfreerequest+0x2c/0xec ncmbind+0x39c/0x3dc usbaddfunction+0xcc/0x1f0 configfscompositebind+0x468/0x588 gadgetbinddriver+0x104/0x270 really_probe+0x190/0x374 __driverprobedevice+0xa0/0x12c driverprobedevice+0x3c/0x218 __deviceattachdriver+0x14c/0x188 bus_foreachdrv+0x10c/0x168 __deviceattach+0xfc/0x198 deviceinitialprobe+0x14/0x24 busprobedevice+0x94/0x11c deviceadd+0x268/0x48c usbaddgadget+0x198/0x28c dwc3gadgetinit+0x700/0x858 _dwc3setmode+0x3cc/0x664 processscheduledworks+0x1d8/0x488 workerthread+0x244/0x334 kthread+0x114/0x1bc retfromfork+0x10/0x20
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40092.json",
"cna_assigner": "Linux"
}