CVE-2025-40315

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-40315
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40315.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-40315
Downstream
Related
Published
2025-12-08T00:46:41.896Z
Modified
2026-03-28T17:44:18.803072890Z
Summary
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

A race condition occurs when ffsfuncepsenable() runs concurrently with ffsdatareset(). The ffsdataclear() called in ffsdatareset() sets ffs->epfiles to NULL before resetting ffs->epscount to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffsfuncepsenable() after successful usbep_enable().

The ffs->epfiles pointer is set to NULL in both ffsdataclear() and ffsdataclose() functions, and its modification is protected by the spinlock ffs->epslock. And the whole ffsfuncepsenable() function is also protected by ffs->eps_lock.

Thus, add NULL pointer handling for ffs->epfiles in the ffsfunceps_enable() function to fix issues

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40315.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c9fc422c9a43e3d58d246334a71f3390401781dc
Fixed
b00d2572c16e8e59e979960d3383c2ae9cebd195
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0042178a69eb77a979e36a50dcce9794a3140ef8
Fixed
1c0dbd240be3f87cac321b14e17979b7e9cb6a8f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
72a8aee863af099d4434314c4536d6c9a61dcf3c
Fixed
9ec40fba7357df2d36f4c2e2f3b9b1a4fba0a272
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ebe2b1add1055b903e2acd86b290a85297edc0b3
Fixed
c53e90563bc148e4e0ad09fe130ba2246d426ea6
Fixed
fc1141a530dfc91f0ee19b7f422a2d24829584bc
Fixed
d62b808d5c68a931ad0849a00a5e3be3dd7e0019
Fixed
30880e9df27332403dd638a82c27921134b3630b
Fixed
cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
32048f4be071f9a6966744243f1786f45bb22dc2
Last affected
cfe5f6fd335d882bcc829a1c8a7d462a455c626e
Last affected
3e078b18753669615301d946297bafd69294ad2c

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40315.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.4.302
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.247
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.197
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.159
Type
ECOSYSTEM
Events
Introduced
5.17.0
Fixed
6.6.117
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.12.58
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.17.8

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40315.json"