Skip to main content

Linux Kernel CVE-2025-40094

HIGH
2025-10-30 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.1 MEDIUM

Local privileged control of gadget configfs (PR:H, AV:L) and a race-like failing-bind precondition (AC:H); impact is a kernel crash only, so A:H with C:N/I:N.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:41 vuln.today
CVE Published
Oct 30, 2025 - 10:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_acm: Refactor bind path to use __free()

After an bind/unbind cycle, the acm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.

Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec gs_free_req+0x30/0x44 acm_bind+0x1b8/0x1f4 usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20

AnalysisAI

Kernel NULL pointer dereference in the Linux USB gadget ACM function (f_acm) allows a local privileged operator to crash the kernel after a USB gadget bind/unbind cycle. After unbind, acm->notify_req is left stale; if a subsequent bind fails, the shared error path frees the stale request and dereferences a NULL ep->ops->free_request pointer in usb_ep_free_request(), producing a fatal oops. Tagged as a Denial of Service issue; EPSS is low (0.19%, 9th percentile), no public exploit is identified, and it is not listed in CISA KEV.

Technical ContextAI

The flaw lives in the USB gadget subsystem's CDC-ACM function driver (drivers/usb/gadget/function/f_acm.c), which exposes a USB serial (modem/ACM) interface when a device operates in USB peripheral/gadget mode via configfs and a UDC such as dwc3. During acm_bind(), the driver allocates a notification endpoint request (acm->notify_req); on unbind this pointer is not cleared, so it becomes stale. On a later failed bind, the unified error label calls gs_free_req() → usb_ep_free_request() on the stale/NULL-backed request, dereferencing ep->ops->free_request at offset 0x20. The root cause class is a NULL pointer dereference (CWE-476) arising from stale-pointer lifecycle mismanagement across bind/unbind; the fix refactors the bind error handling to use the kernel's __free() scope-based automatic cleanup so partially-initialized resources are released correctly.

Affected ProductsAI

The affected product is the Linux kernel, specifically the USB gadget CDC-ACM function driver (f_acm). No exact fixed release version is provided in the input; the six git.kernel.org/stable references (commits 201a66d8, 2b1546f7, 47b2116e, c4301e4d, c5d11686, e348d18f) are backport/fix commits across multiple stable branches, indicating several maintained kernel series are affected on builds that enable CONFIG_USB_CONFIGFS/USB gadget ACM support. No CPE strings were supplied, so precise version ranges cannot be enumerated from this data; the fix landing across multiple stable trees implies both mainline and long-term stable kernels prior to those commits are impacted.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes the f_acm bind-path __free() refactor, tracked by the stable commits at https://git.kernel.org/stable/c/201a66d8e6630762e760e1d78f1d149da1691e7b and its sibling backports (2b1546f7c5fc..., 47b2116e54b4..., c4301e4dd6b3..., c5d116862dd3..., e348d18fb012...); pull the fixed point release for your distribution's stable series once tagged. As a compensating control on systems that do not need USB peripheral/device mode, avoid loading or configuring the ACM gadget function (do not create configfs gadgets binding f_acm) or disable USB gadget/configfs support, which removes the vulnerable code path at the cost of losing USB device-mode serial functionality. Because triggering requires privileged local configfs/UDC access, restrict root and physical/administrative access to the affected devices to reduce exposure until patched.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-40094 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy