FKIE_CVE-2025-40314

Vulnerability from fkie_nvd - Published: 2025-12-08 01:16 - Updated: 2026-10-14 22:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget structure (pdev->gadget) was freed before its endpoints. The endpoints are linked via the ep_list in the gadget structure. Freeing the gadget first leaves dangling pointers in the endpoint list. When the endpoints are subsequently freed, this results in a use-after-free. Fix: By separating the usb_del_gadget_udc() operation into distinct "del" and "put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the final release of the gadget structure with usb_put_gadget(). A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure only after freeing endpoints").
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0cf9a50af91fbdac3849f8d950e883a3eaa3ecea
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/37158ce6ba964b62d1e3eebd11f03c6900a52dd1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/87c5ff5615dc0a37167e8faf3adeeddc6f1344a3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9c52f01429c377a2d32cafc977465f37b5384f77
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ea37884097a0931abb8e11e40eacfb25e9fdb5e9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fdf573c517627a96f5040f988e9b21267806be5c
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/cdns3/cdnsp-gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0cf9a50af91fbdac3849f8d950e883a3eaa3ecea",
              "status": "affected",
              "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
              "versionType": "git"
            },
            {
              "lessThan": "37158ce6ba964b62d1e3eebd11f03c6900a52dd1",
              "status": "affected",
              "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
              "versionType": "git"
            },
            {
              "lessThan": "ea37884097a0931abb8e11e40eacfb25e9fdb5e9",
              "status": "affected",
              "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
              "versionType": "git"
            },
            {
              "lessThan": "9c52f01429c377a2d32cafc977465f37b5384f77",
              "status": "affected",
              "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
              "versionType": "git"
            },
            {
              "lessThan": "fdf573c517627a96f5040f988e9b21267806be5c",
              "status": "affected",
              "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
              "versionType": "git"
            },
            {
              "lessThan": "87c5ff5615dc0a37167e8faf3adeeddc6f1344a3",
              "status": "affected",
              "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/cdns3/cdnsp-gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget\n\nIn the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget\nstructure (pdev-\u003egadget) was freed before its endpoints.\nThe endpoints are linked via the ep_list in the gadget structure.\nFreeing the gadget first leaves dangling pointers in the endpoint list.\nWhen the endpoints are subsequently freed, this results in a use-after-free.\n\nFix:\nBy separating the usb_del_gadget_udc() operation into distinct \"del\" and\n\"put\" steps, cdnsp_gadget_free_endpoints() can be executed prior to the\nfinal release of the gadget structure with usb_put_gadget().\n\nA patch similar to bb9c74a5bd14(\"usb: dwc3: gadget: Free gadget structure\n only after freeing endpoints\")."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: cdns3: gadget: Uso despu\u00e9s de liberaci\u00f3n durante la inicializaci\u00f3n fallida y la salida del gadget cdnsp\n\nEn las funciones __cdnsp_gadget_init() y cdnsp_gadget_exit(), la estructura del gadget (pdev -\u003e gadget) fue liberada antes que sus puntos finales.\nLos puntos finales est\u00e1n vinculados a trav\u00e9s de la ep_list en la estructura del gadget.\nLiberar el gadget primero deja punteros colgantes en la lista de puntos finales.\nCuando los puntos finales son liberados posteriormente, esto resulta en un uso despu\u00e9s de liberaci\u00f3n.\n\nSoluci\u00f3n:\nAl separar la operaci\u00f3n usb_del_gadget_udc() en pasos distintos de \u0027del\u0027 y \u0027put\u0027, cdnsp_gadget_free_endpoints() puede ejecutarse antes de la liberaci\u00f3n final de la estructura del gadget con usb_put_gadget().\n\nUn parche similar a bb9c74a5bd14(\u0027usb: dwc3: gadget: Liberar la estructura del gadget solo despu\u00e9s de liberar los puntos finales\u0027)."
    }
  ],
  "id": "CVE-2025-40314",
  "lastModified": "2026-10-14T22:10:00.210",
  "metrics": {},
  "published": "2025-12-08T01:16:03.877",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0cf9a50af91fbdac3849f8d950e883a3eaa3ecea"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/37158ce6ba964b62d1e3eebd11f03c6900a52dd1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/87c5ff5615dc0a37167e8faf3adeeddc6f1344a3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9c52f01429c377a2d32cafc977465f37b5384f77"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ea37884097a0931abb8e11e40eacfb25e9fdb5e9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fdf573c517627a96f5040f988e9b21267806be5c"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.