Not yet scoredPublished Nov 12, 2025

CVE-2025-40116usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup

Updated under an hour ago (Oct 27, 2026, 11:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for both before dereferencing it.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 05dfa5c9bc37933181b619e42ec0eeb41ef31362 before 89838fe5c6c010ff8d3924f22afd9c18c5c95310; 05dfa5c9bc37933181b619e42ec0eeb41ef31362 builds before 3facf69a735e730ae36387f18780fe420708aa91; from 05dfa5c9bc37933181b619e42ec0eeb41ef31362 before e0e0ce06f3571be9b26790e4df56ba37b1de8543; from 05dfa5c9bc37933181b619e42ec0eeb41ef31362 before 3723c3dda1cc82c9bbca08fcbd46705a361bfd56; from 05dfa5c9bc37933181b619e42ec0eeb41ef31362 before b0439e3762ac9ea580f714e1504a1827d1ad32f5; from 05dfa5c9bc37933181b619e42ec0eeb41ef31362 before e68ea6de1d0551f90d7a2c75f82cb3ebe5e397dc; from 05dfa5c9bc37933181b619e42ec0eeb41ef31362 before b682ce44bf20ada752a2f6ce70d5a575c56f6a35; from 05dfa5c9bc37933181b619e42ec0eeb41ef31362 before 186e8f2bdba551f3ae23396caccd452d985c23e3	CNA record

References

References

https://git.kernel.org/stable/c/89838fe5c6c010ff8d3924f22afd9c18c5c95310
https://git.kernel.org/stable/c/3facf69a735e730ae36387f18780fe420708aa91
https://git.kernel.org/stable/c/e0e0ce06f3571be9b26790e4df56ba37b1de8543
https://git.kernel.org/stable/c/3723c3dda1cc82c9bbca08fcbd46705a361bfd56
https://git.kernel.org/stable/c/b0439e3762ac9ea580f714e1504a1827d1ad32f5
https://git.kernel.org/stable/c/e68ea6de1d0551f90d7a2c75f82cb3ebe5e397dc
https://git.kernel.org/stable/c/b682ce44bf20ada752a2f6ce70d5a575c56f6a35
https://git.kernel.org/stable/c/186e8f2bdba551f3ae23396caccd452d985c23e3

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.