Skip to main content

Linux kernel CVE-2025-40092

HIGH
2025-10-30 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.1 MEDIUM

Requires local privileged control of gadget configfs (PR:H) and a specific bind/unbind/failed-rebind race (AC:H); impact is a kernel crash only, so A:H with C:N/I:N.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:42 vuln.today
CVE Published
Oct 30, 2025 - 10:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: Refactor bind path to use __free()

After an bind/unbind cycle, the ncm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.

Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec ncm_bind+0x39c/0x3dc usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20

AnalysisAI

Local denial of service in the Linux kernel USB gadget NCM function driver (f_ncm) allows a privileged local user managing a USB peripheral-mode gadget to crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves ncm->notify_req stale, a subsequent failing bind reaches a unified error path that frees the stale request, dereferencing ep->ops->free_request on a NULL endpoint. Tagged as Denial of Service; no public exploit identified at time of analysis and EPSS is low (0.19%).

Technical ContextAI

The flaw lives in drivers/usb/gadget/function/f_ncm.c, the CDC NCM (Network Control Model) function used when a Linux device operates in USB peripheral/gadget mode via configfs composite gadgets (commonly on embedded boards, SBCs, and Android-class devices using controllers such as dwc3). During ncm_bind the driver allocates a notification request (notify_req). The reported call trace (usb_ep_free_request -> ncm_bind -> usb_add_function -> configfs_composite_bind -> gadget_bind_driver -> dwc3_gadget_init) shows the crash occurring while probing the gadget driver. The root cause is a use-after-lifecycle/stale-pointer bug: notify_req is not cleared after unbind, so the shared error label in a later failed bind frees an already-invalid request. No CWE was assigned in the input, but this is functionally a NULL pointer dereference (CWE-476) stemming from improper state cleanup; the fix refactors the bind error handling to use the kernel __free() scope-based automatic cleanup mechanism so partially initialized resources are released correctly.

Affected ProductsAI

The vulnerability affects the Linux kernel USB gadget f_ncm function driver. The input does not enumerate exact vulnerable version ranges or CPE strings, but the six git.kernel.org/stable fix commits indicate the bug was present in multiple maintained stable branches and backported broadly. Affected deployments are specifically those running the kernel in USB peripheral/gadget mode with the CDC NCM function enabled. Fix commits: https://git.kernel.org/stable/c/185193a4714aa9c78437a7a1858fbe5771f0f45c , https://git.kernel.org/stable/c/1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2 , https://git.kernel.org/stable/c/75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef , https://git.kernel.org/stable/c/d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee , https://git.kernel.org/stable/c/ed78f4d6079d872432b1ed54f155ef61965d3137 , and https://git.kernel.org/stable/c/f37de8dec6a4c379b4b8486003a1de00ff8cff3b .

RemediationAI

Upstream fix available across six stable-branch commits; a released patched version is not stated in the input, so update to the latest stable/LTS kernel point release for your branch that includes the f_ncm __free() bind-path refactor (verify by cherry-pick hash, e.g. 185193a4714a or the branch-matching commit from the list above). No tagged marketing version is provided, so confirm inclusion via your distribution's changelog. As a compensating control where patching is deferred, avoid or restrict use of the NCM gadget function: do not configure f_ncm in configfs composite gadgets, or restrict who can create/bind gadget configurations (root/configfs access) since triggering requires privileged manipulation of the gadget lifecycle - trade-off is loss of USB Ethernet-over-NCM functionality on affected devices. Avoid repeated bind/unbind cycles on NCM gadgets until patched.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2025-40092 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy