Skip to main content

Linux Kernel CVE-2025-40093

HIGH
2025-10-30 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.4 MEDIUM

Local-only NULL-deref crash requiring privileged configfs/gadget control (PR:H), no confidentiality or integrity impact (C:N/I:N), availability-only DoS (A:H).

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:42 vuln.today
CVE Published
Oct 30, 2025 - 10:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ecm: Refactor bind path to use __free()

After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.

Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.

AnalysisAI

Denial of service in the Linux kernel USB gadget CDC ECM function driver (f_ecm) allows a local privileged operator to crash the kernel via a NULL pointer dereference. After a USB gadget bind/unbind cycle, ecm->notify_req is left stale; if a later bind attempt fails, the shared error path tries to free the stale request and dereferences ep->ops->free_request through a NULL endpoint pointer. No public exploit identified at time of analysis and the practical impact is a kernel crash rather than the full confidentiality/integrity loss implied by the assigned 7.8 CVSS score.

Technical ContextAI

The flaw lives in the USB gadget subsystem's f_ecm.c, which implements the CDC Ethernet Control Model (ECM) function used to expose a device as a USB network adapter. During ecm_bind() a notify_req interrupt request is allocated against a control endpoint; on unbind this pointer is not cleared, so it becomes stale. The consolidated error label in the bind path then calls usb_ep_free_request() on that stale request during a subsequent failed bind, and because the associated endpoint is no longer valid the call dereferences ep->ops->free_request off a NULL pointer. The root cause class is a NULL pointer dereference / stale-pointer misuse (CWE-476, not populated in the input); the fix refactors bind error handling to use the scope-based __free() automatic cleanup macro so the request is never double-managed.

Affected ProductsAI

The Linux kernel is affected, specifically builds compiling the USB gadget CDC ECM function driver (f_ecm / CONFIG_USB_ECM) in USB device/gadget mode - typically embedded, Android, and OTG-capable systems. The input provides no explicit fixed version numbers or CPE strings; affected version ranges must be derived from the five referenced stable-tree commits (e.g. git.kernel.org/stable/c/070f341d86cf2c098d63e484a86c7c1d2696a868 and 15b9faf53ba8719700596e7ef78879ce200e8c2e), which indicate the fix was backported across multiple stable branches. Consult the specific stable series changelogs to map exact vulnerable-to-fixed versions for your kernel.

RemediationAI

Upstream fix available (commit/backport); a specific tagged release version was not provided in the input, so update to the latest stable kernel in your series that includes the f_ecm __free() refactor, referencing the mainline and stable commits at git.kernel.org/stable/c/070f341d86cf2c098d63e484a86c7c1d2696a868, /15b9faf53ba8719700596e7ef78879ce200e8c2e, /42988380ac67c76bb9dff8f77d7ef3eefd50b7b5, /4630c68bade82f087eaaab22e9a361da2f18d139 and /d3745aaef19198d0c81637a7dd50ef53c4f879b7. Where immediate patching is not possible, compensating controls include disabling or not loading the ECM gadget function (avoid CONFIG_USB_ECM / do not configure the ecm function via configfs), restricting access to the USB gadget configfs interface and UDC controls to trusted root-only tooling, and preventing untrusted local users from repeatedly binding/unbinding gadget configurations; the trade-off is loss of USB Ethernet gadget functionality on affected devices. Rebuild/reboot into the fixed kernel to fully close the issue.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-40093 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy