CVE-2025-40116 usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
A null pointer dereference in the Linux kernel's max3421 USB host driver can cause a system crash during probe cleanup.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40116?
CVE-2025-40116 is a vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for both before dereferencing it.
Which versions are affected by CVE-2025-40116?
How do I fix CVE-2025-40116?
Apply the vendor's patch.
Is CVE-2025-40116 being exploited?
There is no known exploitation of CVE-2025-40116 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40116, DEBIAN-CVE-2025-40116, GHSA-pp9h-36fp-569w, ROOT-OS-DEBIAN-11-CVE-2025-40116, ROOT-OS-DEBIAN-13-CVE-2025-40116, ROOT-OS-UBUNTU-2404-CVE-2025-40116 and 1 more.