CVE-2025-68290

most: usb: fix double free on late probe failure

State: Published
Severity: Not scored
Published: Dec 16, 2025
Updated: May 11, 2026
Reserved: Dec 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

most: usb: fix double free on late probe failure

The MOST subsystem has a non-standard registration function which frees the interface on registration failures and on deregistration.

This unsurprisingly leads to bugs in the MOST drivers, and a couple of recent changes turned a reference underflow and use-after-free in the USB driver into several double free and a use-after-free on late probe failures.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 90e6ce2b1b19fb8b9d4afee69f40e4c6a4791154Affected 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before a4c4118c2af284835b16431bbfe77e0130c06fefAffected 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 0dece48660be16918ecf2dbdc7193e8be03e1693Affected 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 993bfdc3842893c394de13c8200c338ebb979589Affected 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 2274767dc02b756b25e3db1e31c0ed47c2a78442Affected 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 8d8ffefe3d5d8b7b73efb866db61130107299c5cAffected 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before baadf2a5c26e802a46573eaad331b427b49aaa36Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.247 through 5.10.Not affected 5.15.197 through 5.15.Not affected 6.1.159 through 6.1.Not affected 6.6.119 through 6.6.Not affected 6.12.61 through 6.12.Not affected 6.17.11 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 90e6ce2b1b19fb8b9d4afee69f40e4c6a4791154Affected
723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before a4c4118c2af284835b16431bbfe77e0130c06fefAffected
723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 0dece48660be16918ecf2dbdc7193e8be03e1693Affected
723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 993bfdc3842893c394de13c8200c338ebb979589Affected
723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 2274767dc02b756b25e3db1e31c0ed47c2a78442Affected
723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before 8d8ffefe3d5d8b7b73efb866db61130107299c5cAffected
723de0f9171eeb49a3ae98cae82ebbbb992b3a7c to before baadf2a5c26e802a46573eaad331b427b49aaa36Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.247 through 5.10.*Not affected
5.15.197 through 5.15.*Not affected
6.1.159 through 6.1.*Not affected
6.6.119 through 6.6.*Not affected
6.12.61 through 6.12.*Not affected
6.17.11 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.