CVE-2025-40315

What it actually does

Race condition between ffs_func_eps_enable() and ffs_data_reset() allows ffs_data_clear() to set ffs->epfiles to NULL before ffs->eps_count reaches zero, resulting in NULL pointer dereference on epfile->ep access inside the spinlock-protected path after usb_ep_enable() succeeds.

Why it matters to the business

Kernel panic or system instability on Linux devices using USB gadget/functionfs, potentially disrupting USB-based services, storage, or networking on affected systems; prevalence in the Linux kernel ecosystem increases exposure for servers, embedded devices, and appliances.

How an attack unfolds

An attacker with ability to trigger concurrent USB gadget setup and reset operations (local or via malicious USB host interaction) races ffs_data_reset() against ffs_func_eps_enable() to force the NULL dereference and crash the kernel.

How to fix it

Upgrade Linux kernel to a fixed version such as 5.4.302 or apply commit b00d2572c16e8e59e979960d3383c2ae9cebd195; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release; inspect source for NULL check on ffs->epfiles inside ffs_func_eps_enable() under eps_lock; monitor for absence of the race in concurrent enable/reset test scenarios.

Typical attack path

1. Configure a USB gadget using functionfs
2. Trigger concurrent ffs_data_reset() and ffs_func_eps_enable() operations
3. Trigger NULL dereference in ffs_func_eps_enable() after epfiles cleared
4. Cause kernel panic or denial of service

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference oops mentioning f_fs, ffs_func_eps_enable, ffs_data_clear, or epfile; correlate with USB gadget initialization or reset events.

• ffs_func_eps_enable
• ffs_data_clear
• ffs->epfiles
• NULL pointer dereference.*f_fs
• epfile->ep

What your security team should do

• Prioritize kernel upgrade on all systems exposing USB gadget/functionfs interfaces
• Apply the referenced stable commit or distribution backport immediately
• Test USB gadget functionality post-upgrade to confirm stability
• Monitor kernel logs for related NULL dereference oops until patched