CVE-2025-40093

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel's USB gadget functionality, specifically within the f ecm module. After a bind/unbind cycle, the ecm->notify req variable can become stale. A subsequent bind failure then attempts to free this stale request, resulting in a NULL pointer dereference when accessing ep->ops->free request. The issue is addressed by refactoring the error handling in the bind path to utilize the free() automatic cleanup mechanism.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.