7.8

CVE-2025-40092: linux

CVSS: 7.8v3.1HighDeferred
AliasesUBUNTU-CVE-2025-40092DEBIAN-CVE-2025-40092
Published 30-10-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2025-40092 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.1% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.15%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 35 · Related 31
DLA-4379-1DSA-6053-1MGASA-2025-0309MGASA-2025-0310OPENSUSE-SU-2025:15702-1OPENSUSE-SU-2026:10301-1

Timeline

  1. 30-10-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Refactor bind path to use __free() After an bind/unbind cycle, the ncm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace: usb_ep_free_request+0x2c/0xec ncm_bind+0x39c/0x3dc usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

+0.01 pp

From 0.14% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu153 products
  • linuxAll versions (No fix recorded) | < 5.15.0-170.180 | < 6.8.0-106.106 | < 6.17.0-14.14
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1100.107 | < 6.8.0-1050.53 | < 6.17.0-1007.7
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.158-1 | < 6.12.57-1 | < 6.17.6-1
Linux1 product
  • linux≥ 9f6ce4240a2bf456402c15c06768059e5973f28c, < 185193a4714aa9c78437a7a1858fbe5771f0f45c | ≥ 9f6ce4240a2bf456402c15c06768059e5973f28c, < f37de8dec6a4c379b4b8486003a1de00ff8cff3b | ≥ 9f6ce4240a2bf456402c15c06768059e5973f28c, < 1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2 | ≥ 9f6ce4240a2bf456402c15c06768059e5973f28c, < d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee | ≥ 9f6ce4240a2bf456402c15c06768059e5973f28c, < ed78f4d6079d872432b1ed54f155ef61965d3137 | ≥ 9f6ce4240a2bf456402c15c06768059e5973f28c, < 75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef | 2.6.38

3 vendors · 155 products

References

39 links
Show all 39 references