CVE-2025-38555: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38555 Overview

CVE-2025-38555 is a use-after-free vulnerability [CWE-416] in the Linux kernel's USB gadget subsystem. The flaw resides in the composite_dev_cleanup() function within the ConfigFS composite gadget driver. When composite_os_desc_req_prepare() encounters a kmalloc failure, it frees the cdev->os_desc_req pointer without resetting it to NULL. A subsequent cleanup path in configfs_composite_bind() then dereferences the dangling pointer, triggering a use-after-free condition detected by KASAN.

The vulnerability affects the mainline Linux kernel and Debian Linux 11. Local attackers with existing privileges on systems using USB gadget functionality can trigger memory corruption leading to kernel-level compromise.

Critical Impact
Successful exploitation can result in kernel memory corruption, privilege escalation, or denial of service on Linux systems running vulnerable USB gadget configurations.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Debian Linux 11.0
Systems using ConfigFS USB gadget composite driver

Discovery Timeline

2025-08-19 - CVE-2025-38555 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38555

Vulnerability Analysis

The vulnerability originates in the Linux kernel's USB gadget composite framework, specifically in the ConfigFS binding pathway. The composite_os_desc_req_prepare() function allocates a request structure used for handling OS descriptor requests from USB hosts. When memory allocation fails partway through initialization, the function frees the cdev->os_desc_req pointer via kfree() but omits setting the pointer to NULL before returning an error to the caller.

The caller configfs_composite_bind() handles the error by invoking composite_dev_cleanup(). This cleanup routine performs a non-NULL check on cdev->os_desc_req before accessing its members. Because the pointer retains its stale value after being freed, the check passes and the cleanup logic reads freed memory. KASAN detected this as an 8-byte read at a freed heap address triggered from composite_dev_cleanup+0xf4/0x2c0.

Root Cause

The root cause is an incomplete error-handling path that violates the free-and-clear invariant for kernel pointers. The pattern requires that any pointer freed during initialization failure be either reset to NULL or excluded from subsequent cleanup traversal. The affected code did neither, leaving a dangling reference that downstream cleanup treats as valid.

Attack Vector

Exploitation requires local access with the ability to interact with the USB gadget ConfigFS interface, typically through gadget_dev_desc_UDC_store writes under /sys/kernel/config/usb_gadget/. An attacker with sufficient privileges to bind a gadget driver can induce the memory allocation failure required to reach the vulnerable path. Memory pressure or fault injection makes the required kmalloc failure reachable in practice.

The vulnerability requires local privileges and no user interaction. Successful exploitation impacts confidentiality, integrity, and availability at the kernel level. Because no public exploit or proof-of-concept has been published, weaponization currently requires independent research into heap layout manipulation.

The vulnerability manifests along this call chain observed in the KASAN report:
  gadget_dev_desc_UDC_store
    -> usb_gadget_probe_driver
      -> udc_bind_to_driver
        -> configfs_composite_bind
          -> composite_os_desc_req_prepare  [kmalloc fails, kfree(os_desc_req), pointer not NULLed]
          -> composite_dev_cleanup          [reads freed os_desc_req -> UAF]

Detection Methods for CVE-2025-38555

Indicators of Compromise

KASAN reports referencing composite_dev_cleanup+0xf4/0x2c0 or use-after-free reads inside the USB gadget subsystem.
Unexpected kernel oopses or panics originating from configfs_composite_bind on systems that expose USB gadget ConfigFS.
Repeated writes to gadget_dev_desc_UDC_store sysfs entries from non-administrative processes.

Detection Strategies

Inventory Linux systems and identify kernels not yet patched against the fix commits listed in the kernel.org stable tree, including 151c0aa8, 2db29235, and e624bf26.
Enable kernel address sanitizer (KASAN) in test environments to surface UAF conditions during USB gadget stress testing.
Monitor dmesg and journal logs for kernel warnings mentioning os_desc_req, composite_dev_cleanup, or KASAN: use-after-free.

Monitoring Recommendations

Alert on user-space processes writing to /sys/kernel/config/usb_gadget/*/UDC outside expected provisioning workflows.
Track memory-pressure conditions correlated with USB gadget bind operations, as attackers may induce allocation failures.
Ingest kernel crash telemetry into a centralized log platform to identify repeated faults on the same host.

How to Mitigate CVE-2025-38555

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits as soon as a maintenance window allows.
Update Debian 11 systems using the fixes announced in the Debian LTS Announcement 00007 and Debian LTS Announcement 00008.
Restrict access to USB gadget ConfigFS interfaces to trusted administrators only.

Patch Information

Upstream fixes are available across stable kernel branches. The relevant commits include 151c0aa8, 2db29235, 5f06ee9f, 8afb22aa, aada327a, bd3c4ef6, dba96dfa, e1be1f38, and e624bf26. Distribution vendors including Debian have shipped backported updates through their standard security channels. Rebuild or reinstall custom kernels to include the corrected error path that resets cdev->os_desc_req to NULL after kfree().

Workarounds

Unload the libcomposite and dependent USB gadget kernel modules on systems that do not require gadget functionality.
Disable CONFIG_USB_CONFIGFS in custom kernel builds where USB gadget ConfigFS is not needed.
Apply mandatory access control policies (SELinux, AppArmor) to prevent unprivileged processes from writing to gadget ConfigFS entries.

bash

# Verify whether the USB gadget ConfigFS module is loaded
lsmod | grep -E 'libcomposite|usb_f_'

# Temporarily unload the module on hosts that do not need gadget mode
sudo modprobe -r libcomposite

# Blacklist the module to prevent it from loading at boot
echo 'blacklist libcomposite' | sudo tee /etc/modprobe.d/disable-usb-gadget.conf