CVE-2025-40314

usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget

State: Published
Severity: Not scored
Published: Dec 8, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget

In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget structure (pdev->gadget) was freed before its endpoints. The endpoints are linked via the ep_list in the gadget structure. Freeing the gadget first leaves dangling pointers in the endpoint list. When the endpoints are subsequently freed, this results in a use-after-free.

Fix: By separating the usb_del_gadget_udc() operation into distinct "del" and "put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the final release of the gadget structure with usb_put_gadget().

A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure only after freeing endpoints").

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8bc1901ca7b07d864fca11461b3875b31f949765 to before 0cf9a50af91fbdac3849f8d950e883a3eaa3eceaAffected 8bc1901ca7b07d864fca11461b3875b31f949765 to before 37158ce6ba964b62d1e3eebd11f03c6900a52dd1Affected 8bc1901ca7b07d864fca11461b3875b31f949765 to before ea37884097a0931abb8e11e40eacfb25e9fdb5e9Affected 8bc1901ca7b07d864fca11461b3875b31f949765 to before 9c52f01429c377a2d32cafc977465f37b5384f77Affected 8bc1901ca7b07d864fca11461b3875b31f949765 to before fdf573c517627a96f5040f988e9b21267806be5cAffected 8bc1901ca7b07d864fca11461b3875b31f949765 to before 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3Affected
LinuxLinux	5.3Affected before 5.3Not affected 5.15.197 through 5.15.Not affected 6.1.159 through 6.1.Not affected 6.6.117 through 6.6.Not affected 6.12.58 through 6.12.Not affected 6.17.8 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

8bc1901ca7b07d864fca11461b3875b31f949765 to before 0cf9a50af91fbdac3849f8d950e883a3eaa3eceaAffected
8bc1901ca7b07d864fca11461b3875b31f949765 to before 37158ce6ba964b62d1e3eebd11f03c6900a52dd1Affected
8bc1901ca7b07d864fca11461b3875b31f949765 to before ea37884097a0931abb8e11e40eacfb25e9fdb5e9Affected
8bc1901ca7b07d864fca11461b3875b31f949765 to before 9c52f01429c377a2d32cafc977465f37b5384f77Affected
8bc1901ca7b07d864fca11461b3875b31f949765 to before fdf573c517627a96f5040f988e9b21267806be5cAffected
8bc1901ca7b07d864fca11461b3875b31f949765 to before 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3Affected

LinuxLinux

5.3Affected
before 5.3Not affected
5.15.197 through 5.15.*Not affected
6.1.159 through 6.1.*Not affected
6.6.117 through 6.6.*Not affected
6.12.58 through 6.12.*Not affected
6.17.8 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.