BaseFortify

Publication date: 2025-12-16

Last updated on: 2025-12-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-16

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68217

EUVD

EUVD-2025-203679

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's pegasus_notetaker driver. The pegasus_probe() function allocates a USB Request Block (URB) transfer buffer based on the wMaxPacketSize value from a USB endpoint descriptor. An attacker can supply a malicious USB descriptor that causes the driver to allocate a very small buffer. Later, if the device sends an interrupt packet with certain byte patterns (such as the first byte being 0x80 or 0x42), the pegasus_parse_packet() function processes the packet without verifying the buffer size, leading to an out-of-bounds memory access.

Impact Analysis

This vulnerability can lead to out-of-bounds memory access in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the memory corruption.

Hi! I’m here to help you understand CVE-2025-68217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70