CVE-2025-40094
- Source
- https://cve.org/CVERecord?id=CVE-2025-40094
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40094.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40094
- Downstream
- Related
- Published
- 2025-10-30T09:48:02.446Z
- Modified
- 2026-03-20T12:43:10.522818Z
- Summary
- usb: gadget: f_acm: Refactor bind path to use __free()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_acm: Refactor bind path to use __free()
After an bind/unbind cycle, the acm->notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->freerequest.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usbepfreerequest+0x2c/0xec gsfreereq+0x30/0x44 acmbind+0x1b8/0x1f4 usbaddfunction+0xcc/0x1f0 configfscompositebind+0x468/0x588 gadgetbinddriver+0x104/0x270 really_probe+0x190/0x374 __driverprobedevice+0xa0/0x12c driverprobedevice+0x3c/0x218 __deviceattachdriver+0x14c/0x188 bus_foreachdrv+0x10c/0x168 __deviceattach+0xfc/0x198 deviceinitialprobe+0x14/0x24 busprobedevice+0x94/0x11c deviceadd+0x268/0x48c usbaddgadget+0x198/0x28c dwc3gadgetinit+0x700/0x858 _dwc3setmode+0x3cc/0x664 processscheduledworks+0x1d8/0x488 workerthread+0x244/0x334 kthread+0x114/0x1bc retfromfork+0x10/0x20
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40094.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/201a66d8e6630762e760e1d78f1d149da1691e7b
- https://git.kernel.org/stable/c/2b1546f7c5fc6c44555a8e7a2b34229d1dcd2175
- https://git.kernel.org/stable/c/47b2116e54b4a854600341487e8b55249e926324
- https://git.kernel.org/stable/c/c4301e4dd6b32faccb744f1c2320e64235b68d3b
- https://git.kernel.org/stable/c/c5d116862dd3ed162d079738a5ebddf9fceea850
- https://git.kernel.org/stable/c/e348d18fb0124b662cfefb3001733b49da428215
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40094.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40094
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1f1ba11b64947051fc32aa15fcccef6463b433f7Fixedc5d116862dd3ed162d079738a5ebddf9fceea850Fixed2b1546f7c5fc6c44555a8e7a2b34229d1dcd2175Fixede348d18fb0124b662cfefb3001733b49da428215Fixed201a66d8e6630762e760e1d78f1d149da1691e7bFixedc4301e4dd6b32faccb744f1c2320e64235b68d3bFixed47b2116e54b4a854600341487e8b55249e926324