CVE-2025-40095

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_rndis: Refactor bind path to use __free()

After an bind/unbind cycle, the rndis->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.

Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.

This vulnerability poses no security risk to Red Hat Enterprise Linux, as the vulnerable USB gadget RNDIS functionality is not included or enabled in supported enterprise kernels. The flaw stems from improper cleanup handling during USB gadget re-binding cycles, which could lead to a kernel crash via a null pointer dereference. Furthermore, exploiting USB gadget drivers requires dedicated peripheral controller hardware running in gadget mode, a configuration absent from standard enterprise deployments.