CVE-2025-40315

Linux Kernel - Buffer Overflow

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix epfile null pointer access after ep enable. A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable(). The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock. Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues

Scores

EPSS 0.0006
EPSS Percentile 18.3%

Details

Status published
Products (34)
linux/Kernel < 5.4.302linux
linux/Kernel 5.11.0 - 5.15.197linux
linux/Kernel 5.16.0 - 6.1.159linux
linux/Kernel 5.17.0 - 6.6.117linux
linux/Kernel 5.5.0 - 5.10.247linux
linux/Kernel 6.2.0 - 6.12.58linux
linux/Kernel 6.7.0 - 6.17.8linux
Linux/Linux < 5.17
Linux/Linux 0042178a69eb77a979e36a50dcce9794a3140ef8 - 1c0dbd240be3f87cac321b14e17979b7e9cb6a8f
Linux/Linux 32048f4be071f9a6966744243f1786f45bb22dc2
... and 24 more
Published Dec 08, 2025
Tracked Since Feb 18, 2026