In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fecm: Refactor bind path to use _free()
After an bind/unbind cycle, the ecm->notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->freerequest.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40093.json"
}