CVE-2025-40314

CVE-2025-40314 describes a use-after-free vulnerability in the Linux kernel's Cadence USB3 Device Controller (CDNS3) gadget driver. This flaw occurs during the initialization or exit of the cdnsp gadget, where the gadget structure is freed before its associated endpoints, leading to dangling pointers and a subsequent use-after-free when the endpoints are later processed. While specific affected products are not listed, it impacts systems utilizing this particular USB driver. The vulnerability has no assigned CVSS score, but its FAUCET Risk Score is 7/100, indicating a low to moderate severity. The attack vector would likely involve local access or a specially crafted USB device interaction, with the potential impact being system instability, crashes, or possibly arbitrary code execution, though the complexity of exploitation is not detailed. There is no evidence of active exploitation, exploit code availability (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. It is not listed in the CISA KEV catalog, suggesting it is not currently a high-priority threat.