In the Linux kernel, the following vulnerability has been resolved:
most: usb: Fix use-after-free in hdm_disconnect
hdm_disconnect() calls most_deregister_interface(), which eventually
unregisters the MOST interface device with device_unregister(iface->dev).
If that drops the last reference, the device core may call release_mdev()
immediately while hdm_disconnect() is still executing.
The old code also freed several mdev-owned allocations in
hdm_disconnect() and then performed additional put_device() calls.
Depending on refcount order, this could lead to use-after-free or
double-free when release_mdev() ran (or when unregister paths also
performed puts).
Fix by moving the frees of mdev-owned allocations into release_mdev(),
so they happen exactly once when the device is truly released, and by
dropping the extra put_device() calls in hdm_disconnect() that are
redundant after device_unregister() and most_deregister_interface().
This addresses the KASAN slab-use-after-free reported by syzbot in
hdm_disconnect(). See report and stack traces in the bug link below.
most: usb: Fix use-after-free in hdm_disconnect
hdm_disconnect() calls most_deregister_interface(), which eventually
unregisters the MOST interface device with device_unregister(iface->dev).
If that drops the last reference, the device core may call release_mdev()
immediately while hdm_disconnect() is still executing.
The old code also freed several mdev-owned allocations in
hdm_disconnect() and then performed additional put_device() calls.
Depending on refcount order, this could lead to use-after-free or
double-free when release_mdev() ran (or when unregister paths also
performed puts).
Fix by moving the frees of mdev-owned allocations into release_mdev(),
so they happen exactly once when the device is truly released, and by
dropping the extra put_device() calls in hdm_disconnect() that are
redundant after device_unregister() and most_deregister_interface().
This addresses the KASAN slab-use-after-free reported by syzbot in
hdm_disconnect(). See report and stack traces in the bug link below.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4404-1 | linux security update |
 Ubuntu USN |
USN-8029-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8030-1 | Linux kernel (GCP) vulnerabilities |
| Ubuntu USN |
USN-8033-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8033-2 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8033-3 | Linux kernel (FIPS) vulnerabilities |
| Ubuntu USN |
USN-8034-1 | Linux kernel (NVIDIA Tegra) vulnerabilities |
| Ubuntu USN |
USN-8033-4 | Linux kernel (AWS) vulnerabilities |
| Ubuntu USN |
USN-8029-2 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8033-5 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8034-2 | Linux kernel (NVIDIA Tegra IGX) vulnerabilities |
| Ubuntu USN |
USN-8048-1 | Linux kernel (OEM) vulnerabilities |
| Ubuntu USN |
USN-8033-6 | Linux kernel (NVIDIA) vulnerabilities |
| Ubuntu USN |
USN-8033-7 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8033-8 | Linux kernel (Intel IoTG) vulnerabilities |
| Ubuntu USN |
USN-8029-3 | Linux kernel (Azure) vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 06 Dec 2025 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Thu, 04 Dec 2025 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdm_disconnect hdm_disconnect() calls most_deregister_interface(), which eventually unregisters the MOST interface device with device_unregister(iface->dev). If that drops the last reference, the device core may call release_mdev() immediately while hdm_disconnect() is still executing. The old code also freed several mdev-owned allocations in hdm_disconnect() and then performed additional put_device() calls. Depending on refcount order, this could lead to use-after-free or double-free when release_mdev() ran (or when unregister paths also performed puts). Fix by moving the frees of mdev-owned allocations into release_mdev(), so they happen exactly once when the device is truly released, and by dropping the extra put_device() calls in hdm_disconnect() that are redundant after device_unregister() and most_deregister_interface(). This addresses the KASAN slab-use-after-free reported by syzbot in hdm_disconnect(). See report and stack traces in the bug link below. | |
| Title | most: usb: Fix use-after-free in hdm_disconnect | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2025-12-04T15:31:15.158Z
Reserved: 2025-04-16T07:20:57.180Z
Link: CVE-2025-40223
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2025-12-04T16:16:14.767
Modified: 2025-12-04T17:15:08.283
Link: CVE-2025-40223
Redhat
OpenCVE Enrichment
No data.
Weaknesses
No weakness.