CVE-2025-40093

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ecm: Refactor bind path to use __free()

After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.

Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.

This vulnerability presents minimal risk to Red Hat environments as the affected code is not present in supported Red Hat Enterprise Linux releases. The issue requires local access to trigger a kernel crash via repeated device binding failures on systems running specialized USB device controller configurations. Because Red Hat Enterprise Linux is typically deployed in standard server environments without USB gadget mode active, default systems are not exposed to this flaw.