Not yet scoredPublished Dec 16, 2025

CVE-2025-68249most: usb: hdm_probe: Fix calling put_device() before device initialization

Updated under an hour ago (Oct 26, 2026, 1:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: most: usb: hdm_probe: Fix calling put_device() before device initialization The early error path in hdm_probe() can jump to err_free_mdev before &mdev->dev has been initialized with device_initialize(). Calling put_device(&mdev->dev) there triggers a device core WARN and ends up invoking kref_put(&kobj->kref, kobject_release) on an uninitialized kobject. In this path the private struct was only kmalloc'ed and the intended release is effectively kfree(mdev) anyway, so free it directly instead of calling put_device() on an uninitialized device. This removes the WARNING and fixes the pre-initialization error path.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 97a6f772f36b7f52bcfa56a581bbd2470cffe23d before 3509c748e79435d09e730673c8c100b7f0ebc87c; from 97a6f772f36b7f52bcfa56a581bbd2470cffe23d before ad2be44882716dc3589fbc5572cc13f88ead6b24; from 97a6f772f36b7f52bcfa56a581bbd2470cffe23d before c400410fe0580dd6118ae8d60287ac9ce71a65fd; 97a6f772f36b7f52bcfa56a581bbd2470cffe23d builds before 6fb8fbc0aa542af5bf0fed94fa6b0edf18144f95; 97a6f772f36b7f52bcfa56a581bbd2470cffe23d builds before 7d851f746067b8ee5bac9c262f326ace0a6ea253; 97a6f772f36b7f52bcfa56a581bbd2470cffe23d builds before 4af0eedbdb4df7936bf43a28e31af232744d2620; from 97a6f772f36b7f52bcfa56a581bbd2470cffe23d before a8cc9e5fcb0e2eef21513a4fec888f5712cb8162	CNA record

References

References

https://git.kernel.org/stable/c/3509c748e79435d09e730673c8c100b7f0ebc87c
https://git.kernel.org/stable/c/ad2be44882716dc3589fbc5572cc13f88ead6b24
https://git.kernel.org/stable/c/c400410fe0580dd6118ae8d60287ac9ce71a65fd
https://git.kernel.org/stable/c/6fb8fbc0aa542af5bf0fed94fa6b0edf18144f95
https://git.kernel.org/stable/c/7d851f746067b8ee5bac9c262f326ace0a6ea253
https://git.kernel.org/stable/c/4af0eedbdb4df7936bf43a28e31af232744d2620
https://git.kernel.org/stable/c/a8cc9e5fcb0e2eef21513a4fec888f5712cb8162

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.