In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
A race condition occurs when ffsfuncepsenable() runs concurrently with ffsdatareset(). The ffsdataclear() called in ffsdatareset() sets ffs->epfiles to NULL before resetting ffs->epscount to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffsfuncepsenable() after successful usbep_enable().
The ffs->epfiles pointer is set to NULL in both ffsdataclear() and ffsdataclose() functions, and its modification is protected by the spinlock ffs->epslock. And the whole ffsfuncepsenable() function is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the ffsfunceps_enable() function to fix issues
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40315.json",
"cna_assigner": "Linux"
}