Skip to main content

Linux Kernel CVE-2025-40095

HIGH
2025-10-30 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.5 MEDIUM

Local gadget-config control needed (AV:L/PR:L); NULL deref yields only a kernel crash, so C:N/I:N and A:H rather than the input's full CIA impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:41 vuln.today
CVE Published
Oct 30, 2025 - 10:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_rndis: Refactor bind path to use __free()

After an bind/unbind cycle, the rndis->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.

Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.

AnalysisAI

Denial of service in the Linux kernel's USB gadget RNDIS function driver (f_rndis) lets a local privileged user crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves rndis->notify_req stale, a subsequently failing bind reaches a unified error path that calls free_request on the stale request, dereferencing ep->ops->free_request on freed/NULL state. Tagged as Denial of Service; no public exploit is identified, EPSS is low (0.19%, 9th percentile), and it is not on CISA KEV.

Technical ContextAI

The flaw lives in the USB gadget subsystem's RNDIS function (drivers/usb/gadget/function/f_rndis.c), which implements Microsoft's Remote NDIS protocol to expose a USB-attached device as an Ethernet interface (commonly on embedded/Android USB gadget devices configured via configfs). During the gadget bind path the driver allocates an interrupt notification endpoint request (notify_req); after an unbind this pointer is not cleared, so it is left dangling. A later bind attempt that fails jumps to a shared cleanup label that unconditionally frees notify_req, dereferencing the endpoint's ep->ops->free_request through a stale pointer. Although the NVD lists no CWE, this is fundamentally a NULL pointer dereference (CWE-476) rooted in improper cleanup of a stale resource pointer (CWE-459/dangling state). The fix refactors the bind error handling to use the kernel's __free() scope-based automatic cleanup so the request is released deterministically and the stale-pointer path is eliminated.

Affected ProductsAI

The affected product is the Linux kernel, specifically the USB gadget RNDIS function driver (f_rndis). The input provides no explicit affected version range or CPE; the five git.kernel.org/stable commit references (08228941, 380353c3, 5f65c8ad, a8366263, ef81226b) indicate the fix was backported across multiple stable branches, implying several maintained kernel series contained the stale notify_req handling before the fix. Only builds that enable USB gadget support with the RNDIS function (CONFIG_USB_CONFIGFS_RNDIS / f_rndis) and expose bind/unbind control are practically affected. Authoritative commit list: https://git.kernel.org/stable/c/ef81226bb1f8b6e761cd0b53d2696e9c1bc955d1 (and the four sibling stable commits).

RemediationAI

Upstream fix available (stable commits); a specific released tag is not provided in the input, so apply the distribution kernel update that incorporates the referenced stable commits (08228941436047bdcd35a612c1aec0912a29d8cd, 380353c3a92be7d928e6f973bd065c5b79755ac3, 5f65c8ad8c7292ed7e3716343fcd590a51818cc3, a8366263b7e5b663d7fb489d3a9ba1e2600049a6, ef81226bb1f8b6e761cd0b53d2696e9c1bc955d1) via git.kernel.org, or upgrade to your vendor's patched kernel once it lands. If immediate patching is not possible, the practical compensating control is to avoid the vulnerable code path: do not build/load the RNDIS gadget function (disable CONFIG_USB_CONFIGFS_RNDIS or unload f_rndis) on devices that do not require USB RNDIS networking, and restrict access to USB gadget configuration (configfs UDC bind/unbind) to trusted administrators only - the trade-off is loss of USB RNDIS Ethernet-over-USB functionality on affected devices. Because exploitation is local and privileged, tightening who can drive gadget bind/unbind cycles meaningfully reduces exposure.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-40095 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy