LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38555: usb: gadget : fix use-after-free in composite_dev_cleanup()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite_bind() -> composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be freed but not set to NULL. Then it will return a failure to the upper-level function. 2. in func configfs_composite_bind() -> composite_dev_cleanup(): it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it will attempt to use it.This will lead to a use-after-free issue. BUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0 Read of size 8 at addr 0000004827837a00 by task init/1 CPU: 10 PID: 1 Comm: init Tainted: G O 5.10.97-oh #1 kasan_report+0x188/0x1cc __asan_load8+0xb4/0xbc composite_dev_cleanup+0xf4/0x2c0 configfs_composite_bind+0x210/0x7ac udc_bind_to_driver+0xb4/0x1ec usb_gadget_probe_driver+0xec/0x21c gadget_dev_desc_UDC_store+0x264/0x27c

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux’s USB gadget composite cleanup path can reuse kernel memory after it has been freed. Under specific local conditions, this could crash or corrupt a system and is scored as potentially compromising confidentiality, integrity, and availability.

Executive priority

Prioritize remediation for appliances, embedded devices, and other Linux systems actively using USB gadget configuration, especially where untrusted local access exists. Treat other systems as lower immediate exposure while confirming whether the vulnerable functionality and affected code are present.

Technical view

If allocation fails in composite_os_desc_req_prepare(), cdev->os_desc_req is freed without being set to NULL. Error handling then reaches composite_dev_cleanup(), which treats the stale pointer as valid and reads freed memory. KASAN confirmed the use-after-free during USB gadget configuration binding.

Likely exposure

Exposure is likely limited to Linux systems using USB gadget composite functionality through configfs. Triggering requires an allocation failure during OS descriptor preparation, followed by cleanup. The affected-version data spans multiple kernel releases but does not clearly map every distribution backport; verify running vendor kernels against advisories and linked fixes.

Exploitation context

The bundle marks KEV false and provides no evidence of active exploitation or public weaponization. CVSS describes a local, low-complexity, low-privilege, no-user-interaction path. However, the reported trigger depends on memory allocation failure within USB gadget binding, so practical exploitability is not established by these sources.

Researcher notes

The evidence establishes a KASAN-detected read-after-free in an error-cleanup path. It does not demonstrate controlled exploitation, privilege escalation, or a specific confidentiality or integrity outcome. Version records are difficult to interpret without distribution backport information; use commit ancestry or vendor advisories for confirmation.

Mitigation direction

  • Install the appropriate vendor kernel update containing the linked stable fix.
  • Review Debian LTS advisories when operating supported Debian LTS releases.
  • Confirm vendor guidance for distribution-specific fixed versions and backports.
  • Prioritize systems exposing USB gadget configuration to locally untrusted users.

Validation and detection

  • Inventory running kernel versions on systems using USB gadget functionality.
  • Determine whether the applicable stable fix or vendor backport is installed.
  • Review kernel logs for KASAN reports referencing composite_dev_cleanup().
  • Confirm patched systems boot and USB gadget configurations still bind successfully.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38555 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
12Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38555Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux37a3a533429ef9b3cc9f15a656c19623f0e88df7, 37a3a533429ef9b3cc9f15a656c19623f0e88df7, 37a3a533429ef9b3cc9f15a656c19623f0e88df7, 37a3a533429ef9b3cc9f15a656c19623f0e88df7, 37a3a533429ef9b3cc9f15a656c19623f0e88df7, 37a3a533429ef9b3cc9f15a656c19623f0e88df7, 37a3a533429ef9b3cc9f15a656c19623f0e88df7, 37a3a533429ef9b3cc9f15a656c19623f0e88df7, 37a3a533429ef9b3cc9f15a656c19623f0e88df7unaffected
LinuxLinux3.16, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.148, 6.6.102, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.