Critical Vulnerability in Linux Package: NULL Pointer Dereference in RNDIS Gadget
Summary
DEBIAN-CVE-2025-40095: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Refactor bind path to use free() After an bind/unbind cycle, the rndis->notify_req is left stale. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, providing essential services for hardware and software interaction. It supports a wide range of devices and functionalities, making it a critical element for system stability and performance. The kernel is continuously updated to address security vulnerabilities and improve performance. This specific vulnerability affects the RNDIS (Remote Network Driver Interface Specification) gadget, which is used for network communication over USB. The issue arises from improper error handling during the bind/unbind cycle, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RNDIS gadget where the 'notify_req' remains stale after a bind/unbind cycle. If a subsequent bind operation fails, the error handling mechanism attempts to free this stale request, resulting in a NULL pointer dereference when accessing 'ep->ops->free_request'. This can lead to system instability and crashes, posing a significant risk to users relying on USB network functionalities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate risks.
Conclusion
The identified vulnerability in the Linux kernel's RNDIS gadget poses a significant risk to system stability due to potential NULL pointer dereference. Users are urged to update their systems promptly to mitigate this risk and ensure continued functionality of USB network services.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes due to NULL pointer dereference, affecting the stability of systems using the RNDIS gadget.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, users are encouraged to update their Linux package to the latest version where this vulnerability has been addressed.
While there are no specific workarounds, it is advisable to monitor the situation and apply the patch as soon as it is available.
Detailed information can be found in the official Debian security advisories and the CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
