FKIE_CVE-2025-40315

Vulnerability from fkie_nvd - Published: 2025-12-08 01:16 - Updated: 2026-10-14 22:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix epfile null pointer access after ep enable. A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable(). The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock. Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1c0dbd240be3f87cac321b14e17979b7e9cb6a8f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/30880e9df27332403dd638a82c27921134b3630b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9ec40fba7357df2d36f4c2e2f3b9b1a4fba0a272
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b00d2572c16e8e59e979960d3383c2ae9cebd195
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c53e90563bc148e4e0ad09fe130ba2246d426ea6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d62b808d5c68a931ad0849a00a5e3be3dd7e0019
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fc1141a530dfc91f0ee19b7f422a2d24829584bc
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b00d2572c16e8e59e979960d3383c2ae9cebd195",
              "status": "affected",
              "version": "c9fc422c9a43e3d58d246334a71f3390401781dc",
              "versionType": "git"
            },
            {
              "lessThan": "1c0dbd240be3f87cac321b14e17979b7e9cb6a8f",
              "status": "affected",
              "version": "0042178a69eb77a979e36a50dcce9794a3140ef8",
              "versionType": "git"
            },
            {
              "lessThan": "9ec40fba7357df2d36f4c2e2f3b9b1a4fba0a272",
              "status": "affected",
              "version": "72a8aee863af099d4434314c4536d6c9a61dcf3c",
              "versionType": "git"
            },
            {
              "lessThan": "c53e90563bc148e4e0ad09fe130ba2246d426ea6",
              "status": "affected",
              "version": "ebe2b1add1055b903e2acd86b290a85297edc0b3",
              "versionType": "git"
            },
            {
              "lessThan": "fc1141a530dfc91f0ee19b7f422a2d24829584bc",
              "status": "affected",
              "version": "ebe2b1add1055b903e2acd86b290a85297edc0b3",
              "versionType": "git"
            },
            {
              "lessThan": "d62b808d5c68a931ad0849a00a5e3be3dd7e0019",
              "status": "affected",
              "version": "ebe2b1add1055b903e2acd86b290a85297edc0b3",
              "versionType": "git"
            },
            {
              "lessThan": "30880e9df27332403dd638a82c27921134b3630b",
              "status": "affected",
              "version": "ebe2b1add1055b903e2acd86b290a85297edc0b3",
              "versionType": "git"
            },
            {
              "lessThan": "cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4",
              "status": "affected",
              "version": "ebe2b1add1055b903e2acd86b290a85297edc0b3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "32048f4be071f9a6966744243f1786f45bb22dc2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cfe5f6fd335d882bcc829a1c8a7d462a455c626e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3e078b18753669615301d946297bafd69294ad2c",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.302",
              "status": "affected",
              "version": "5.4.180",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.247",
              "status": "affected",
              "version": "5.10.101",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.197",
              "status": "affected",
              "version": "5.15.24",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.267",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.230",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix epfile null pointer access after ep enable.\n\nA race condition occurs when ffs_func_eps_enable() runs concurrently\nwith ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()\nsets ffs-\u003eepfiles to NULL before resetting ffs-\u003eeps_count to 0, leading\nto a NULL pointer dereference when accessing epfile-\u003eep in\nffs_func_eps_enable() after successful usb_ep_enable().\n\nThe ffs-\u003eepfiles pointer is set to NULL in both ffs_data_clear() and\nffs_data_close() functions, and its modification is protected by the\nspinlock ffs-\u003eeps_lock. And the whole ffs_func_eps_enable() function\nis also protected by ffs-\u003eeps_lock.\n\nThus, add NULL pointer handling for ffs-\u003eepfiles in the\nffs_func_eps_enable() function to fix issues"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_fs: Soluci\u00f3n al acceso a puntero nulo de epfile despu\u00e9s de la habilitaci\u00f3n de ep.\n\nUna condici\u00f3n de carrera ocurre cuando ffs_func_eps_enable() se ejecuta concurrentemente con ffs_data_reset(). La funci\u00f3n ffs_data_clear() llamada en ffs_data_reset() establece ffs -\u003e epfiles a NULL antes de restablecer ffs -\u003e eps_count a 0, lo que lleva a una desreferenciaci\u00f3n de puntero NULL al acceder a epfile -\u003e ep en ffs_func_eps_enable() despu\u00e9s de una usb_ep_enable() exitosa.\n\nEl puntero ffs -\u003e epfiles se establece a NULL tanto en las funciones ffs_data_clear() como ffs_data_close(), y su modificaci\u00f3n est\u00e1 protegida por el spinlock ffs -\u003e eps_lock. Y toda la funci\u00f3n ffs_func_eps_enable() tambi\u00e9n est\u00e1 protegida por ffs -\u003e eps_lock.\n\nPor lo tanto, se a\u00f1ade el manejo de punteros NULL para ffs -\u003e epfiles en la funci\u00f3n ffs_func_eps_enable() para solucionar los problemas."
    }
  ],
  "id": "CVE-2025-40315",
  "lastModified": "2026-10-14T22:10:00.210",
  "metrics": {},
  "published": "2025-12-08T01:16:04.013",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1c0dbd240be3f87cac321b14e17979b7e9cb6a8f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/30880e9df27332403dd638a82c27921134b3630b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9ec40fba7357df2d36f4c2e2f3b9b1a4fba0a272"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b00d2572c16e8e59e979960d3383c2ae9cebd195"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c53e90563bc148e4e0ad09fe130ba2246d426ea6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d62b808d5c68a931ad0849a00a5e3be3dd7e0019"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fc1141a530dfc91f0ee19b7f422a2d24829584bc"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.