CVE-2025-40314
Description
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget structure (pdev->gadget) was freed before its endpoints. The endpoints are linked via the ep_list in the gadget structure. Freeing the gadget first leaves dangling pointers in the endpoint list. When the endpoints are subsequently freed, this results in a use-after-free. Fix: By separating the usb_del_gadget_udc() operation into distinct "del" and "put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the final release of the gadget structure with usb_put_gadget(). A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure only after freeing endpoints").
How to fix
- Linux Linux0cf9a50af91fbdac3849f8d950e883a3eaa3ecea, 37158ce6ba964b62d1e3eebd11f03c6900a52dd1, ea37884097a0931abb8e11e40eacfb25e9fdb5e9, 9c52f01429c377a2d32cafc977465f37b5384f77, fdf573c517627a96f5040f988e9b21267806be5c, 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 8bc1901ca7b07d864fca11461b3875b31f949765 ≤ v < 0cf9a50af91fbdac3849f8d950e883a3eaa3ecea, 8bc1901ca7b07d864fca11461b3875b31f949765 ≤ v < 37158ce6ba964b62d1e3eebd11f03c6900a52dd1, 8bc1901ca7b07d864fca11461b3875b31f949765 ≤ v < ea37884097a0931abb8e11e40eacfb25e9fdb5e9, 8bc1901ca7b07d864fca11461b3875b31f949765 ≤ v < 9c52f01429c377a2d32cafc977465f37b5384f77, 8bc1901ca7b07d864fca11461b3875b31f949765 ≤ v < fdf573c517627a96f5040f988e9b21267806be5c, 8bc1901ca7b07d864fca11461b3875b31f949765 ≤ v < 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3, 5.3 | 0cf9a50af91fbdac3849f8d950e883a3eaa3ecea, 37158ce6ba964b62d1e3eebd11f03c6900a52dd1, ea37884097a0931abb8e11e40eacfb25e9fdb5e9, 9c52f01429c377a2d32cafc977465f37b5384f77, fdf573c517627a96f5040f988e9b21267806be5c, 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.