Use-After-Free Vulnerability in Linux Kernel Affecting MOST Interface Device

CVE-2025-40223

What is CVE-2025-40223?

A vulnerability exists in the Linux kernel's handling of the MOST interface device, where an improper sequence of operations during the hdm_disconnect() function can lead to a use-after-free condition. This flaw occurs when the last reference to the MOST interface device is released while the function is still executing, potentially allowing an attacker to exploit this situation. The issue has been resolved by ensuring that relevant memory allocations are handled correctly in the release_mdev() function, preventing the occurrence of multiple frees that could compromise system stability and security.

References