CVE-2025-40223

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

most: usb: Fix use-after-free in hdm_disconnect

hdm_disconnect() calls most_deregister_interface(), which eventually

unregisters the MOST interface device with device_unregister(iface->dev).

If that drops the last reference, the device core may call release_mdev()

immediately while hdm_disconnect() is still executing.

The old code also freed several mdev-owned allocations in

hdm_disconnect() and then performed additional put_device() calls.

Depending on refcount order, this could lead to use-after-free or

double-free when release_mdev() ran (or when unregister paths also

performed puts).

Fix by moving the frees of mdev-owned allocations into release_mdev(),

so they happen exactly once when the device is truly released, and by

dropping the extra put_device() calls in hdm_disconnect() that are

redundant after device_unregister() and most_deregister_interface().

This addresses the KASAN slab-use-after-free reported b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References