Executive brief
A vulnerability exists in the Linux kernel's USB gadget subsystem, which manages how a Linux device acts as a USB peripheral (like a mass storage device or network adapter). A specific error in memory management can occur when the system fails to allocate memory during the setup of USB descriptors. This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized code, impacting the overall stability and security of the device.
Technical details
A use-after-free (UAF) vulnerability exists in `drivers/usb/gadget/composite.c` within the `composite_dev_cleanup()` function. The issue stems from `composite_os_desc_req_prepare()`, where if a memory allocation for `cdev->os_desc_req->buf` fails, the `os_desc_req` pointer is freed via `usb_ep_free_request()` but is not subsequently set to NULL. When the initialization sequence fails and falls back to `composite_dev_cleanup()`, the function performs a non-NULL check on the stale pointer and attempts to access it, resulting in a UAF. This can be triggered by a local user with sufficient privileges to configure USB gadget devices via configfs. Patches have been released across multiple stable kernel branches to ensure the pointer is zeroed after being freed.
Affected products
- Linux Linux Kernel 3.16 to 5.4.297, 5.10.224, 5.15.165, 6.1.105, 6.6.46, 6.10.5
Timeline
- 2025-07-21: patched: Initial patch submitted to stable tree
- 2025-08-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/151c0aa896c47a4459e07fee7d4843f44c1bb18e
- https://git.kernel.org/stable/c/2db29235e900a084a656dea7e0939b0abb7bb897
- https://git.kernel.org/stable/c/5f06ee9f9a3665d43133f125c17e5258a13f3963
- https://git.kernel.org/stable/c/8afb22aa063f706f3343707cdfb8cda4d021dd33
- https://git.kernel.org/stable/c/aada327a9f8028c573636fa60c0abc80fb8135c9
- https://git.kernel.org/stable/c/bd3c4ef60baf7f65c963f3e12d9d7b2b091e20ba
- https://git.kernel.org/stable/c/dba96dfa5a0f685b959dd28a52ac8dab0b805204