« Volver al listado

CVE-2025-68217

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

Input: pegasus-notetaker - fix potential out-of-bounds access

In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer.

Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68217",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "1afca2b66aac7ac262d3511c68725e9e7053b40f",
              "lessThan": "c4e746651bd74c38f581e1cf31651119a94de8cd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1afca2b66aac7ac262d3511c68725e9e7053b40f",
              "lessThan": "36bc92b838ff72f62f2c17751a9013b29ead2513",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1afca2b66aac7ac262d3511c68725e9e7053b40f",
              "lessThan": "015b719962696b793997e8deefac019f816aca77",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1afca2b66aac7ac262d3511c68725e9e7053b40f",
              "lessThan": "084264e10e2ae8938a54355123ad977eb9df56d6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1afca2b66aac7ac262d3511c68725e9e7053b40f",
              "lessThan": "d344ea1baf1946c90f0cd6f9daeb5f3e0a0ca479",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1afca2b66aac7ac262d3511c68725e9e7053b40f",
              "lessThan": "9ab67eff6d654e34ba6da07c64761aa87c2a3c26",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1afca2b66aac7ac262d3511c68725e9e7053b40f",
              "lessThan": "763c3f4d2394a697d14af1335d3bb42f05c9409f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1afca2b66aac7ac262d3511c68725e9e7053b40f",
              "lessThan": "69aeb507312306f73495598a055293fa749d454e",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/input/tablet/pegasus_notetaker.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/input/tablet/pegasus_notetaker.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-16T14:15:54.763",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/015b719962696b793997e8deefac019f816aca77",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/084264e10e2ae8938a54355123ad977eb9df56d6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/36bc92b838ff72f62f2c17751a9013b29ead2513",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/69aeb507312306f73495598a055293fa749d454e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/763c3f4d2394a697d14af1335d3bb42f05c9409f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9ab67eff6d654e34ba6da07c64761aa87c2a3c26",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c4e746651bd74c38f581e1cf31651119a94de8cd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d344ea1baf1946c90f0cd6f9daeb5f3e0a0ca479",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: pegasus-notetaker - fix potential out-of-bounds access\n\nIn the pegasus_notetaker driver, the pegasus_probe() function allocates\nthe URB transfer buffer using the wMaxPacketSize value from\nthe endpoint descriptor. An attacker can use a malicious USB descriptor\nto force the allocation of a very small buffer.\n\nSubsequently, if the device sends an interrupt packet with a specific\npattern (e.g., where the first byte is 0x80 or 0x42),\nthe pegasus_parse_packet() function parses the packet without checking\nthe allocated buffer size. This leads to an out-of-bounds memory access."
    }
  ],
  "lastModified": "2026-06-17T09:58:45.177",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}