CVE-2025-40094

CVE-2025-40094 affects the Linux kernel’s USB gadget f_acm binding path. After a bind/unbind cycle, acm->notify_req can be left stale, and if a subsequent bind fails, the unified error label may try to free it, causing a NULL pointer dereference when accessing ep->ops->free_request. The ...