Executive brief
A vulnerability in the Linux kernel's USB gadget driver could allow a local user to crash the system. The issue occurs when the system attempts to clean up resources after a failed connection attempt of a USB network device. This can lead to a system crash (kernel panic), potentially disrupting operations or allowing further exploitation.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's USB RNDIS gadget driver (f_rndis.c). The flaw is triggered during a bind/unbind cycle where the 'rndis->notify_req' pointer is left in a stale state. If a subsequent bind operation fails, the error handling logic attempts to free this stale request, resulting in a NULL pointer dereference when accessing 'ep->ops->free_request'. An attacker with local access could potentially trigger this condition to cause a denial of service (system crash). The issue has been resolved by refactoring the bind path to use the '__free()' automatic cleanup mechanism to ensure proper resource management.
Affected products
- Linux Linux 2.6.27 to 6.1.158, 6.6.114, 6.12.55, 6.17.5
Timeline
- 2025-10-30: advisory: NVD publication date
- 2025-09-17: patched: Mainline kernel patch applied
References
- https://git.kernel.org/stable/c/08228941436047bdcd35a612c1aec0912a29d8cd
- https://git.kernel.org/stable/c/380353c3a92be7d928e6f973bd065c5b79755ac3
- https://git.kernel.org/stable/c/5f65c8ad8c7292ed7e3716343fcd590a51818cc3
- https://git.kernel.org/stable/c/a8366263b7e5b663d7fb489d3a9ba1e2600049a6
- https://git.kernel.org/stable/c/ef81226bb1f8b6e761cd0b53d2696e9c1bc955d1