Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-40315

usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.302, 5.10.247, 5.15.197, 4.15, 4.20, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix epfile null pointer access after ep enable. A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable(). The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock. Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 5.4.180 · fixed in 5.4.302; From 5.10.101 · fixed in 5.10.247; From 5.15.24 · fixed in 5.15.197; From 4.14.267 · fixed in 4.15; From 4.19.230 · fixed in 4.20; From 5.16.10 · fixed in 5.17

  • Linux Linux

    5.17

References 8

git.kernel.org