Critical NULL Pointer Dereference Vulnerability in Linux Package - CVE-2025-40093
Summary
DEBIAN-CVE-2025-40093: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ecm: Refactor bind path to use free() After an bind/unbind cycle, the ecm->notify_req is left stale. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It is widely used across various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the USB gadget subsystem, which is responsible for USB device communication. The issue arises during the bind/unbind cycle of the ECM (Ethernet Control Model) driver, leading to potential system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the USB gadget subsystem, specifically within the f_ecm driver. After a bind/unbind cycle, the ecm->notify_req variable is left in a stale state. If a subsequent bind operation fails, the error handling mechanism attempts to free this stale request, which results in a NULL pointer dereference when accessing ep->ops->free_request. This could lead to a system crash or unexpected behavior, making it a critical vulnerability that needs immediate attention.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as it becomes available to mitigate any risks associated with this issue.
Conclusion
The CVE-2025-40093 vulnerability in the Linux kernel poses a significant risk due to its potential to cause system crashes through a NULL pointer dereference. Users are urged to update their Linux packages promptly to ensure system stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-40093 is a vulnerability in the Linux kernel's USB gadget subsystem that can lead to a NULL pointer dereference, potentially causing system crashes.
If your system uses the affected Linux kernel version, it may experience instability or crashes during USB device operations.
All versions of the Linux package in Debian 11, 12, 13, and 14 are affected. It is crucial to update to the patched version.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
While there are no specific workarounds, it is advisable to limit the use of USB devices until the patch is applied to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
