CVE-2025-40095

usb: gadget: f_rndis: Refactor bind path to use __free()

State: Published
Severity: 7.8 High
Published: Oct 30, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_rndis: Refactor bind path to use __free()

After an bind/unbind cycle, the rndis->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.

Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	45fe3b8e5342cd1ce307099459c74011d8e01986 to before ef81226bb1f8b6e761cd0b53d2696e9c1bc955d1Affected 45fe3b8e5342cd1ce307099459c74011d8e01986 to before 5f65c8ad8c7292ed7e3716343fcd590a51818cc3Affected 45fe3b8e5342cd1ce307099459c74011d8e01986 to before 380353c3a92be7d928e6f973bd065c5b79755ac3Affected 45fe3b8e5342cd1ce307099459c74011d8e01986 to before a8366263b7e5b663d7fb489d3a9ba1e2600049a6Affected 45fe3b8e5342cd1ce307099459c74011d8e01986 to before 08228941436047bdcd35a612c1aec0912a29d8cdAffected
LinuxLinux	2.6.27Affected before 2.6.27Not affected 6.1.158 through 6.1.Not affected 6.6.114 through 6.6.Not affected 6.12.55 through 6.12.Not affected 6.17.5 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

45fe3b8e5342cd1ce307099459c74011d8e01986 to before ef81226bb1f8b6e761cd0b53d2696e9c1bc955d1Affected
45fe3b8e5342cd1ce307099459c74011d8e01986 to before 5f65c8ad8c7292ed7e3716343fcd590a51818cc3Affected
45fe3b8e5342cd1ce307099459c74011d8e01986 to before 380353c3a92be7d928e6f973bd065c5b79755ac3Affected
45fe3b8e5342cd1ce307099459c74011d8e01986 to before a8366263b7e5b663d7fb489d3a9ba1e2600049a6Affected
45fe3b8e5342cd1ce307099459c74011d8e01986 to before 08228941436047bdcd35a612c1aec0912a29d8cdAffected

LinuxLinux

2.6.27Affected
before 2.6.27Not affected
6.1.158 through 6.1.*Not affected
6.6.114 through 6.6.*Not affected
6.12.55 through 6.12.*Not affected
6.17.5 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.