Security readout for executives and security teams
Plain-English summary
A flaw in the Linux USB network gadget component can crash the kernel during a specific reconfiguration failure. Because a kernel crash can disrupt embedded devices, appliances, or systems using USB networking, affected deployments should update promptly. The supplied sources do not establish remote reachability or observed exploitation.
Executive priority
Prioritize affected embedded devices, appliances, and other systems using USB gadget NCM, especially where crashes interrupt critical services. Treat this as an urgent patching issue within that operational subset, not as evidence of broad internet exploitation. Confirm exposure before emergency action because the vulnerable path requires specific USB gadget configuration and lifecycle conditions.
Technical view
After an f_ncm bind/unbind cycle, notify_req can retain a stale request pointer. If a later bind fails, shared error cleanup passes that request to usb_ep_free_request, causing a NULL pointer dereference through the endpoint operations table. The referenced Linux stable commits refactor bind cleanup using __free().
Likely exposure
Exposure is most likely on Linux systems that enable the USB gadget NCM function and undergo bind, unbind, and subsequent failed-bind conditions. The supplied affected-version data spans multiple kernel branches but is insufficiently clear for reliable range-based conclusions; compare each deployed kernel with vendor advisories and the referenced stable commits.
Exploitation context
The CVSS 3.1 vector rates this as local, low-complexity, low-privilege, with no user interaction and high confidentiality, integrity, and availability impact. However, the description specifically demonstrates a kernel NULL-pointer crash. KEV is false, and the supplied sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The stale notify_req survives unbind and is later freed through a failed bind cleanup path. The provided commit references appear to cover multiple stable branches, but the bundle does not map each commit to an explicit fixed release. The stated CVSS impact exceeds what the crash trace alone proves, so additional confidentiality or integrity consequences remain unsubstantiated here.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check Linux distribution or device-vendor guidance for fixed package versions.
- Prioritize systems actively using the USB gadget NCM function.
- Use vendor-recommended mitigations if immediate kernel replacement is unavailable.
Validation and detection
- Inventory kernels on devices configured to provide USB NCM gadget networking.
- Compare kernel builds against vendor fixed versions and the referenced stable commits.
- Review kernel logs for ncm_bind or usb_ep_free_request NULL-pointer traces.
- After updating, confirm the running kernel contains the applicable fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40092 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/185193a4714aa9c78437a7a1858fbe5771f0f45cCVE reference, Linux
- https://git.kernel.org/stable/c/f37de8dec6a4c379b4b8486003a1de00ff8cff3bCVE reference, Linux
- https://git.kernel.org/stable/c/1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2CVE reference, Linux
- https://git.kernel.org/stable/c/d3fe7143928d8dfa2ec7bac9f906b48bc75b98eeCVE reference, Linux
- https://git.kernel.org/stable/c/ed78f4d6079d872432b1ed54f155ef61965d3137CVE reference, Linux
- https://git.kernel.org/stable/c/75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295efCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.