Linux Kernel Vulnerability in USB Gadget Functionality

CVE-2025-40092

What is CVE-2025-40092?

A vulnerability has been identified in the Linux kernel's USB gadget functionality, specifically within the f_ncm driver. The issue arises during the bind and unbind cycle, where stale requests can lead to a NULL pointer dereference. This occurs if a subsequent bind fails, and the system attempts to clean up a stale request, resulting in a crash. To mitigate this, the error handling in the bind path has been refactored to implement an automatic cleanup mechanism, enhancing overall stability and security.

References