CVE-2025-40314 usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
A use-after-free in the Linux kernel's cdns3 USB gadget driver allows local attackers to cause denial of service or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40314?
CVE-2025-40314 is an use after free vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget structure (pdev->gadget) was freed before its endpoints. The endpoints are linked via the ep_list in the gadget structure. Freeing the gadget first leaves dangling pointers in the endpoint list. When the endpoints are subsequently freed, this results in a use-after-free.
Fix: By separating the usb_del_gadget_udc() operation into distinct "del" and "put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the final release of the gadget structure with usb_put_gadget().
A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure only after freeing endpoints").
Which versions are affected by CVE-2025-40314?
How do I fix CVE-2025-40314?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-40314 being exploited?
There is no known exploitation of CVE-2025-40314 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40314, DEBIAN-CVE-2025-40314, GHSA-5pr8-9989-4xqp, ROOT-OS-DEBIAN-11-CVE-2025-40314, ROOT-OS-DEBIAN-12-CVE-2025-40314, ROOT-OS-DEBIAN-13-CVE-2025-40314 and 3 more.