PT-2025-44385 · Linux+3 · Linux Kernel+3
Publicado
2025-09-17
·
Atualizado
2026-05-26
·
CVE-2025-40095
CVSS v2.0
4.6
Média
| Vetor | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel’s USB gadget functionality, specifically within the
f rndis component. After a bind/unbind cycle, the rndis->notify req pointer can become stale. A subsequent bind failure then attempts to free this stale request, resulting in a NULL pointer dereference when accessing ep->ops->free request. The issue is addressed by refactoring the error handling in the bind path to utilize the free() automatic cleanup mechanism.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Resource Release
NULL Pointer Dereference
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Debian
Linuxmint
Linux Kernel
Ubuntu