GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40092 (GCVE-0-2025-40092)

Vulnerability from cvelistv5 – Published: 2025-10-30 09:47 – Updated: 2026-08-05 12:07
VLAI
Title
usb: gadget: f_ncm: Refactor bind path to use __free()
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Refactor bind path to use __free() After an bind/unbind cycle, the ncm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec ncm_bind+0x39c/0x3dc usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9f6ce4240a2bf456402c15c06768059e5973f28c , < 185193a4714aa9c78437a7a1858fbe5771f0f45c (git)
Affected: 9f6ce4240a2bf456402c15c06768059e5973f28c , < f37de8dec6a4c379b4b8486003a1de00ff8cff3b (git)
Affected: 9f6ce4240a2bf456402c15c06768059e5973f28c , < 1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2 (git)
Affected: 9f6ce4240a2bf456402c15c06768059e5973f28c , < d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee (git)
Affected: 9f6ce4240a2bf456402c15c06768059e5973f28c , < ed78f4d6079d872432b1ed54f155ef61965d3137 (git)
Affected: 9f6ce4240a2bf456402c15c06768059e5973f28c , < 75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.38
Unaffected: 0 , < 2.6.38 (semver)
Unaffected: 5.15.196 , ≤ 5.15.* (semver)
Unaffected: 6.1.158 , ≤ 6.1.* (semver)
Unaffected: 6.6.114 , ≤ 6.6.* (semver)
Unaffected: 6.12.55 , ≤ 6.12.* (semver)
Unaffected: 6.17.5 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_ncm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "185193a4714aa9c78437a7a1858fbe5771f0f45c",
              "status": "affected",
              "version": "9f6ce4240a2bf456402c15c06768059e5973f28c",
              "versionType": "git"
            },
            {
              "lessThan": "f37de8dec6a4c379b4b8486003a1de00ff8cff3b",
              "status": "affected",
              "version": "9f6ce4240a2bf456402c15c06768059e5973f28c",
              "versionType": "git"
            },
            {
              "lessThan": "1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2",
              "status": "affected",
              "version": "9f6ce4240a2bf456402c15c06768059e5973f28c",
              "versionType": "git"
            },
            {
              "lessThan": "d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee",
              "status": "affected",
              "version": "9f6ce4240a2bf456402c15c06768059e5973f28c",
              "versionType": "git"
            },
            {
              "lessThan": "ed78f4d6079d872432b1ed54f155ef61965d3137",
              "status": "affected",
              "version": "9f6ce4240a2bf456402c15c06768059e5973f28c",
              "versionType": "git"
            },
            {
              "lessThan": "75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef",
              "status": "affected",
              "version": "9f6ce4240a2bf456402c15c06768059e5973f28c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_ncm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.196",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: Refactor bind path to use __free()\n\nAfter an bind/unbind cycle, the ncm-\u003enotify_req is left stale. If a\nsubsequent bind fails, the unified error label attempts to free this\nstale request, leading to a NULL pointer dereference when accessing\nep-\u003eops-\u003efree_request.\n\nRefactor the error handling in the bind path to use the __free()\nautomatic cleanup mechanism.\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000020\nCall trace:\n usb_ep_free_request+0x2c/0xec\n ncm_bind+0x39c/0x3dc\n usb_add_function+0xcc/0x1f0\n configfs_composite_bind+0x468/0x588\n gadget_bind_driver+0x104/0x270\n really_probe+0x190/0x374\n __driver_probe_device+0xa0/0x12c\n driver_probe_device+0x3c/0x218\n __device_attach_driver+0x14c/0x188\n bus_for_each_drv+0x10c/0x168\n __device_attach+0xfc/0x198\n device_initial_probe+0x14/0x24\n bus_probe_device+0x94/0x11c\n device_add+0x268/0x48c\n usb_add_gadget+0x198/0x28c\n dwc3_gadget_init+0x700/0x858\n __dwc3_set_mode+0x3cc/0x664\n process_scheduled_works+0x1d8/0x488\n worker_thread+0x244/0x334\n kthread+0x114/0x1bc\n ret_from_fork+0x10/0x20"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The entire bind \u2192 unbind \u2192 failing-rebind sequence that dereferences the stale `ncm-\u003enotify_req` is driven by local writes to `/sys/kernel/config/usb_gadget/\u003cg\u003e/UDC` and function/config symlinks; no USB host traffic, cable event, or physical port access is required since any UDC (including dummy_hcd) suffices.\nAC:L - The attacker deterministically controls each step \u2014 the first successful `ncm_bind()`, the `purge_configs_funcs()`/unbind that leaves `ncm-\u003enotify_req` and `ncm-\u003enotify` dangling, and the forced failure of the next bind by exhausting `usb_interface_id()` (MAX_CONFIG_INTERFACES) or `usb_ep_autoconfig()` with extra functions linked in between cycles \u2014 plus the heap spray reclaiming the freed `usb_request`. No race or condition outside attacker control is involved.\nPR:L - `gadget_dev_desc_UDC_store()` and `ncm_bind()` perform no capability check whatsoever; access is gated only by configfs file permissions, and on Android and embedded/industrial systems the USB gadget configfs tree is routinely delegated to non-root system/daemon accounts that switch tethering (NCM/ECM/RNDIS) functions.\nUI:N - The attacker performs all configfs writes itself; no victim action, cable plug/unplug, or interaction with another user is needed to reach the stale free.\nS:U - The dangling-pointer free and resulting heap corruption remain within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `kfree(ncm-\u003enotify_req-\u003ebuf)` reads a pointer out of the reclaimed `usb_request` (e.g. `dummy_request`/`dwc3_request`) slab object and `usb_ep_free_request()` reads `ep-\u003eops` from a potentially freed `struct usb_ep`, so an attacker grooming those generic kmalloc caches gains object-overlap and arbitrary-free primitives readily converted into kernel memory disclosure.\nI:H - `kfree()` of an attacker-controlled pointer read from the freed request, a double free of the `usb_request` itself, and an indirect call through a reclaimable `ep-\u003eops` table together yield classic heap-corruption primitives leading to arbitrary write and privilege escalation.\nA:H - The directly observed effect is a kernel oops \u2014 NULL/garbage `ep-\u003eops` dereference in `usb_ep_free_request()` per the reported call trace \u2014 and the double free independently causes slab corruption and panic, repeatable at will by whoever holds the configfs tree."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:43.366Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/185193a4714aa9c78437a7a1858fbe5771f0f45c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f37de8dec6a4c379b4b8486003a1de00ff8cff3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed78f4d6079d872432b1ed54f155ef61965d3137"
        },
        {
          "url": "https://git.kernel.org/stable/c/75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef"
        }
      ],
      "title": "usb: gadget: f_ncm: Refactor bind path to use __free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40092",
    "datePublished": "2025-10-30T09:47:59.910Z",
    "dateReserved": "2025-04-16T07:20:57.163Z",
    "dateUpdated": "2026-08-05T12:07:43.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40092",
      "date": "2026-09-16",
      "epss": "0.00144",
      "percentile": "0.04069"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-31T01:10:32.000Z",
      "cve": "CVE-2025-40092",
      "id": "msrc_CVE-2025-40092",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: gadget: f_ncm: Refactor bind path to use __free()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40092.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40092\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-30T10:15:33.713\",\"lastModified\":\"2026-07-30T06:24:10.930\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: gadget: f_ncm: Refactor bind path to use __free()\\n\\nAfter an bind/unbind cycle, the ncm-\u003enotify_req is left stale. If a\\nsubsequent bind fails, the unified error label attempts to free this\\nstale request, leading to a NULL pointer dereference when accessing\\nep-\u003eops-\u003efree_request.\\n\\nRefactor the error handling in the bind path to use the __free()\\nautomatic cleanup mechanism.\\n\\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000020\\nCall trace:\\n usb_ep_free_request+0x2c/0xec\\n ncm_bind+0x39c/0x3dc\\n usb_add_function+0xcc/0x1f0\\n configfs_composite_bind+0x468/0x588\\n gadget_bind_driver+0x104/0x270\\n really_probe+0x190/0x374\\n __driver_probe_device+0xa0/0x12c\\n driver_probe_device+0x3c/0x218\\n __device_attach_driver+0x14c/0x188\\n bus_for_each_drv+0x10c/0x168\\n __device_attach+0xfc/0x198\\n device_initial_probe+0x14/0x24\\n bus_probe_device+0x94/0x11c\\n device_add+0x268/0x48c\\n usb_add_gadget+0x198/0x28c\\n dwc3_gadget_init+0x700/0x858\\n __dwc3_set_mode+0x3cc/0x664\\n process_scheduled_works+0x1d8/0x488\\n worker_thread+0x244/0x334\\n kthread+0x114/0x1bc\\n ret_from_fork+0x10/0x20\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/gadget/function/f_ncm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9f6ce4240a2bf456402c15c06768059e5973f28c\",\"lessThan\":\"185193a4714aa9c78437a7a1858fbe5771f0f45c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f6ce4240a2bf456402c15c06768059e5973f28c\",\"lessThan\":\"f37de8dec6a4c379b4b8486003a1de00ff8cff3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f6ce4240a2bf456402c15c06768059e5973f28c\",\"lessThan\":\"1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f6ce4240a2bf456402c15c06768059e5973f28c\",\"lessThan\":\"d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f6ce4240a2bf456402c15c06768059e5973f28c\",\"lessThan\":\"ed78f4d6079d872432b1ed54f155ef61965d3137\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f6ce4240a2bf456402c15c06768059e5973f28c\",\"lessThan\":\"75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/gadget/function/f_ncm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.38\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.38\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.196\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.158\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.114\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.55\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.5\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/185193a4714aa9c78437a7a1858fbe5771f0f45c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed78f4d6079d872432b1ed54f155ef61965d3137\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f37de8dec6a4c379b4b8486003a1de00ff8cff3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:08:22+00:00",
      "cve": "CVE-2025-40092",
      "id": "CVE-2025-40092",
      "initial_release_date": "2025-10-30T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: gadget: f_ncm: Refactor bind path to use __free()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40092.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.