CVE-2025-40314
- Source
- https://cve.org/CVERecord?id=CVE-2025-40314
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40314.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40314
- Downstream
- Related
- Published
- 2025-12-08T00:46:40.576Z
- Modified
- 2026-03-12T03:54:40.342303Z
- Summary
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
In the _cdnspgadgetinit() and cdnspgadgetexit() functions, the gadget structure (pdev->gadget) was freed before its endpoints. The endpoints are linked via the eplist in the gadget structure. Freeing the gadget first leaves dangling pointers in the endpoint list. When the endpoints are subsequently freed, this results in a use-after-free.
Fix: By separating the usbdelgadgetudc() operation into distinct "del" and "put" steps, cdnspgadgetfreeendpoints() can be executed prior to the final release of the gadget structure with usbputgadget().
A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure only after freeing endpoints").
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40314.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0cf9a50af91fbdac3849f8d950e883a3eaa3ecea
- https://git.kernel.org/stable/c/37158ce6ba964b62d1e3eebd11f03c6900a52dd1
- https://git.kernel.org/stable/c/87c5ff5615dc0a37167e8faf3adeeddc6f1344a3
- https://git.kernel.org/stable/c/9c52f01429c377a2d32cafc977465f37b5384f77
- https://git.kernel.org/stable/c/ea37884097a0931abb8e11e40eacfb25e9fdb5e9
- https://git.kernel.org/stable/c/fdf573c517627a96f5040f988e9b21267806be5c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40314.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40314
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8bc1901ca7b07d864fca11461b3875b31f949765Fixed0cf9a50af91fbdac3849f8d950e883a3eaa3eceaFixed37158ce6ba964b62d1e3eebd11f03c6900a52dd1Fixedea37884097a0931abb8e11e40eacfb25e9fdb5e9Fixed9c52f01429c377a2d32cafc977465f37b5384f77Fixedfdf573c517627a96f5040f988e9b21267806be5cFixed87c5ff5615dc0a37167e8faf3adeeddc6f1344a3