CVE-2025-40223
Description
In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdm_disconnect hdm_disconnect() calls most_deregister_interface(), which eventually unregisters the MOST interface device with device_unregister(iface->dev). If that drops the last reference, the device core may call release_mdev() immediately while hdm_disconnect() is still executing. The old code also freed several mdev-owned allocations in hdm_disconnect() and then performed additional put_device() calls. Depending on refcount order, this could lead to use-after-free or double-free when release_mdev() ran (or when unregister paths also performed puts). Fix by moving the frees of mdev-owned allocations into release_mdev(), so they happen exactly once when the device is truly released, and by dropping the extra put_device() calls in hdm_disconnect() that are redundant after device_unregister() and most_deregister_interface(). This addresses the KASAN slab-use-after-free reported by syzbot in hdm_disconnect(). See report and stack traces in the bug link below.
How to fix
- Linux Linux5b5c478f09b1b35e7fe6fc9a1786c9bf6030e831, 578eb18cd111addec94c43f61cd4b4429e454809, 33daf469f5294b9d07c4fc98216cace9f4f34cc6, 72427dc6f87523995f4e6ae35a948bb2992cabce, f93a84ffb884d761a9d4e869ba29c238711e81f1, 3a3b8e89c7201c5b3b76ac4a4069d1adde1477d6, 4b1270902609ef0d935ed2faa2ea6d122bd148f5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 97a6f772f36b7f52bcfa56a581bbd2470cffe23d ≤ v < 5b5c478f09b1b35e7fe6fc9a1786c9bf6030e831, 97a6f772f36b7f52bcfa56a581bbd2470cffe23d ≤ v < 578eb18cd111addec94c43f61cd4b4429e454809, 97a6f772f36b7f52bcfa56a581bbd2470cffe23d ≤ v < 33daf469f5294b9d07c4fc98216cace9f4f34cc6, 97a6f772f36b7f52bcfa56a581bbd2470cffe23d ≤ v < 72427dc6f87523995f4e6ae35a948bb2992cabce, 97a6f772f36b7f52bcfa56a581bbd2470cffe23d ≤ v < f93a84ffb884d761a9d4e869ba29c238711e81f1, 97a6f772f36b7f52bcfa56a581bbd2470cffe23d ≤ v < 3a3b8e89c7201c5b3b76ac4a4069d1adde1477d6, 97a6f772f36b7f52bcfa56a581bbd2470cffe23d ≤ v < 4b1270902609ef0d935ed2faa2ea6d122bd148f5, 5.9 | 5b5c478f09b1b35e7fe6fc9a1786c9bf6030e831, 578eb18cd111addec94c43f61cd4b4429e454809, 33daf469f5294b9d07c4fc98216cace9f4f34cc6, 72427dc6f87523995f4e6ae35a948bb2992cabce, f93a84ffb884d761a9d4e869ba29c238711e81f1, 3a3b8e89c7201c5b3b76ac4a4069d1adde1477d6, 4b1270902609ef0d935ed2faa2ea6d122bd148f5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.