CVE-2025-40093

Summary

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ecm: Refactor bind path to use __free()

After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.

Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxda741b8c56d612b5dd26ffa31341911a5fea23ee < d3745aaef19198d0c81637a7dd50ef53c4f879b7affected
LinuxLinuxda741b8c56d612b5dd26ffa31341911a5fea23ee < 070f341d86cf2c098d63e484a86c7c1d2696a868affected
LinuxLinuxda741b8c56d612b5dd26ffa31341911a5fea23ee < 15b9faf53ba8719700596e7ef78879ce200e8c2eaffected
LinuxLinuxda741b8c56d612b5dd26ffa31341911a5fea23ee < 4630c68bade82f087eaaab22e9a361da2f18d139affected
LinuxLinuxda741b8c56d612b5dd26ffa31341911a5fea23ee < 42988380ac67c76bb9dff8f77d7ef3eefd50b7b5affected
LinuxLinux2.6.27affected
LinuxLinux0 < 2.6.27unaffected
LinuxLinux6.1.158 <= 6.1.*unaffected
LinuxLinux6.6.114 <= 6.6.*unaffected
LinuxLinux6.12.55 <= 6.12.*unaffected
LinuxLinux6.17.5 <= 6.17.*unaffected
LinuxLinux6.18 <= *unaffected

Weaknesses

References