CVE-2025-68343
Unknown Unknown - Not Provided
Integer Underflow in Linux Kernel gs_usb Driver Causes Memory Access Error

Publication date: 2025-12-23

Last updated on: 2025-12-23

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it. To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-23
Last Modified
2025-12-23
Generated
2026-06-16
AI Q&A
2025-12-23
EPSS Evaluated
2026-06-15
NVD
CVE-2025-68343
EUVD
EUVD-2025-204798
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's gs_usb driver involves improper checking of the actual_length before accessing the header in the gs_usb_receive_bulk_callback() function. The driver expects to receive a struct gs_host_frame, but it did not verify that the received data was at least the size of the header before accessing its members. This could lead to dereferencing invalid pointers if the received data is too short. The fix involves using struct_group to describe the header and checking the length before access, and correctly resubmitting the URB by using a pointer that is always defined.

Impact Analysis

This vulnerability could lead to kernel crashes or undefined behavior due to dereferencing invalid pointers when processing USB data in the gs_usb driver. This may result in system instability or potential denial of service if exploited.

Mitigation Strategies

Apply the patch or update to the fixed version of the Linux kernel that includes the correction in the gs_usb driver, specifically the fix in gs_usb_receive_bulk_callback() to properly check actual_length before accessing the header. Avoid using vulnerable kernel versions until patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68343. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart