CVE-2025-40314

What it actually does

Use-after-free in __cdnsp_gadget_init() and cdnsp_gadget_exit() where the gadget structure is freed before its endpoints, leaving dangling pointers in the ep_list that are later dereferenced during endpoint cleanup.

Why it matters to the business

Kernel memory corruption on affected Linux systems using the cdns3 USB gadget driver can lead to system instability, crashes, or potential privilege escalation; the issue affects many embedded and server deployments but carries low exploitation likelihood based on current threat data.

How an attack unfolds

An attacker with local access triggers the gadget initialization or exit paths (for example via USB device attach or driver unload), causing the UAF when endpoints are freed after the gadget structure; no named threat actors or ransomware campaigns are associated with this flaw.

How to fix it

Update to fixed kernel versions containing commit 0cf9a50af91fbdac3849f8d950e883a3eaa3ecea; for Ubuntu systems apply the listed package updates (1.0.25-7ubuntu2.2+esm1 for 14.04 ESM, 1.0.25-10ubuntu0.16.04.2 for 16.04, 1.0.28-4ubuntu0.18.04.1 for 18.04, 1.0.28-6 for 20.04).

How to confirm the fix worked

Verify the running kernel contains commit 0cf9a50af91fbdac3849f8d950e883a3eaa3ecea or the corresponding Ubuntu package versions; inspect dmesg and kernel logs for cdns3/cdnsp gadget initialization sequences after patching.

Typical attack path

1. Obtain local access on a system using the cdns3 USB gadget driver
2. Trigger gadget initialization or exit (device attach, driver load/unload, or error path)
3. Trigger the UAF via dangling ep_list pointers during endpoint freeing
4. Leverage resulting memory corruption for denial of service or code execution

How to detect it

Review kernel logs for cdns3 or cdnsp gadget init/exit errors, unusual USB gadget activity, or oops/panic messages referencing ep_list or gadget structures; no specific named threat actor indicators are known.

What your security team should do

• Prioritize patching kernel packages on all systems exposing the cdns3 USB gadget driver
• Apply the exact fixed versions listed for each Ubuntu release and the mainline commit
• Monitor EPSS and KEV updates given the 322-day publication age and stable low exploitation probability
• Limit local access and USB gadget functionality where possible until patches are deployed