Linux Kernel Vulnerability in USB Gadget by Linux Foundation

CVE-2025-40093

What is CVE-2025-40093?

A vulnerability within the Linux kernel affects the USB Gadget functionality related to the ECM (Ethernet Control Model). The issue arises during the bind/unbind cycle, where the notify request associated with the ECM becomes stale. If a subsequent bind operation fails, the system tries to free this stale request, which can trigger a NULL pointer dereference when accessing the operation to free requests. The vulnerability has been addressed by refactoring the error handling in the bind path to utilize an automatic cleanup mechanism, ensuring improved stability and reliability.

References