CVE-2025-38555

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget : fix use-after-free in composite_dev_cleanup()<br /> <br /> 1. In func configfs_composite_bind() -&gt; composite_os_desc_req_prepare():<br /> if kmalloc fails, the pointer cdev-&gt;os_desc_req will be freed but not<br /> set to NULL. Then it will return a failure to the upper-level function.<br /> 2. in func configfs_composite_bind() -&gt; composite_dev_cleanup():<br /> it will checks whether cdev-&gt;os_desc_req is NULL. If it is not NULL, it<br /> will attempt to use it.This will lead to a use-after-free issue.<br /> <br /> BUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0<br /> Read of size 8 at addr 0000004827837a00 by task init/1<br /> <br /> CPU: 10 PID: 1 Comm: init Tainted: G O 5.10.97-oh #1<br /> kasan_report+0x188/0x1cc<br /> __asan_load8+0xb4/0xbc<br /> composite_dev_cleanup+0xf4/0x2c0<br /> configfs_composite_bind+0x210/0x7ac<br /> udc_bind_to_driver+0xb4/0x1ec<br /> usb_gadget_probe_driver+0xec/0x21c<br /> gadget_dev_desc_UDC_store+0x264/0x27c