Security readout for executives and security teams
Plain-English summary
A Linux USB gadget networking flaw can crash the kernel during specific device reconfiguration failures. Systems using the Ethernet Control Model gadget function are the likely concern. The supplied record rates it 7.8 High, but the documented mechanism establishes a denial-of-service condition more clearly than data theft or code execution.
Executive priority
Prioritize embedded devices, appliances, and systems intentionally operating as USB network gadgets. Treat confirmed exposed systems as high-priority patching candidates because a local actor may trigger a kernel failure. General Linux servers without USB gadget ECM use are less likely to be exposed.
Technical view
After an f_ecm bind/unbind cycle, ecm->notify_req can remain stale. If a later bind fails, shared cleanup attempts to free that request and dereferences ep->ops->free_request through a NULL pointer. Linux resolved the error path by using automatic __free() cleanup.
Likely exposure
Exposure appears limited to Linux systems that build or use the USB gadget f_ecm function and encounter the required bind, unbind, and failed rebinding sequence. The supplied affected-version data is broad and contains ambiguous entries, so kernel commit ancestry or distributor guidance should determine exposure.
Exploitation context
The CVSS vector describes local, low-privilege, low-complexity access without user interaction. The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. It also does not establish remote network exploitation.
Researcher notes
The documented primitive is stale-request cleanup followed by a NULL pointer dereference. Although CVSS claims high confidentiality, integrity, and availability impacts, the supplied technical description directly substantiates a crash path; it does not explain data disclosure, privilege escalation, or code execution. Exact version-to-fix mapping requires commit or vendor analysis.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable Linux stable correction.
- Check distributor guidance for the fixed package corresponding to your kernel branch.
- Restrict untrusted local access where prompt kernel updates are not possible.
- Disable unused USB gadget ECM functionality if operationally safe and vendor-supported.
Validation and detection
- Inventory kernel versions and identify devices using USB gadget ECM functionality.
- Compare kernel commit ancestry against the five referenced Linux stable corrections.
- Confirm fixed package status through the operating-system or appliance vendor.
- Review kernel crash records for f_ecm cleanup or free_request NULL dereferences.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40093 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d3745aaef19198d0c81637a7dd50ef53c4f879b7CVE reference, Linux
- https://git.kernel.org/stable/c/070f341d86cf2c098d63e484a86c7c1d2696a868CVE reference, Linux
- https://git.kernel.org/stable/c/15b9faf53ba8719700596e7ef78879ce200e8c2eCVE reference, Linux
- https://git.kernel.org/stable/c/4630c68bade82f087eaaab22e9a361da2f18d139CVE reference, Linux
- https://git.kernel.org/stable/c/42988380ac67c76bb9dff8f77d7ef3eefd50b7b5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.