CVE-2025-40094

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw related to USB gadget functionality, specifically within the f acm module. A NULL pointer dereference can occur after a bind/unbind cycle, potentially leading to system instability. This happens when a stale request remains in acm->notify req and a subsequent bind fails, causing an attempt to free this stale request. The issue is addressed by refactoring the error handling in the bind path to utilize the free() automatic cleanup mechanism.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.