CVE-2025-40314: usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
In the cdnspgadgetinit() and cdnspgadgetexit() functions, the gadget structure (pdev->gadget) was freed before its endpoints. The endpoints are linked via the eplist in the gadget structure. Freeing the gadget first leaves dangling pointers in the endpoint list. When the endpoints are subsequently freed, this results in a use-after-free.
Fix: By separating the usbdelgadgetudc() operation into distinct "del" and "put" steps, cdnspgadgetfreeendpoints() can be executed prior to the final release of the gadget structure with usbputgadget().
A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure only after freeing endpoints").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1006.7~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-14.14 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1006.7 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-14.14.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch bb9c74a5bd14
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40314?
CVE-2025-40314 has been rated as a medium severity vulnerability due to the potential for a use-after-free exploitation.
How do I fix CVE-2025-40314?
To fix CVE-2025-40314, ensure that your Linux kernel is updated to the latest stable version that addresses this vulnerability.
What does CVE-2025-40314 affect?
CVE-2025-40314 affects the Linux kernel specifically in the cdns3 USB gadget driver.
What are the consequences of exploiting CVE-2025-40314?
Exploiting CVE-2025-40314 may lead to unintended behaviors, including potential system crashes or arbitrary code execution.
When was CVE-2025-40314 discovered?
CVE-2025-40314 was identified and documented as a vulnerability in the Linux kernel in 2025.