CVE-2025-40095
High
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Refactor bind path to use __free() After an bind/unbind cycle, the rndis->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Linux
PublishedOct 30, 2025
First seenOct 30, 2025
How to fix
Update
- Linux Linuxef81226bb1f8b6e761cd0b53d2696e9c1bc955d1, 5f65c8ad8c7292ed7e3716343fcd590a51818cc3, 380353c3a92be7d928e6f973bd065c5b79755ac3, a8366263b7e5b663d7fb489d3a9ba1e2600049a6, 08228941436047bdcd35a612c1aec0912a29d8cd or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 45fe3b8e5342cd1ce307099459c74011d8e01986 ≤ v < ef81226bb1f8b6e761cd0b53d2696e9c1bc955d1, 45fe3b8e5342cd1ce307099459c74011d8e01986 ≤ v < 5f65c8ad8c7292ed7e3716343fcd590a51818cc3, 45fe3b8e5342cd1ce307099459c74011d8e01986 ≤ v < 380353c3a92be7d928e6f973bd065c5b79755ac3, 45fe3b8e5342cd1ce307099459c74011d8e01986 ≤ v < a8366263b7e5b663d7fb489d3a9ba1e2600049a6, 45fe3b8e5342cd1ce307099459c74011d8e01986 ≤ v < 08228941436047bdcd35a612c1aec0912a29d8cd, 2.6.27 | ef81226bb1f8b6e761cd0b53d2696e9c1bc955d1, 5f65c8ad8c7292ed7e3716343fcd590a51818cc3, 380353c3a92be7d928e6f973bd065c5b79755ac3, a8366263b7e5b663d7fb489d3a9ba1e2600049a6, 08228941436047bdcd35a612c1aec0912a29d8cd |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.