« Volver al listado

CVE-2025-68342

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

The URB received in gs_usb_receive_bulk_callback() contains a struct gs_host_frame. The length of the data after the header depends on the gs_host_frame hf::flags and the active device features (e.g. time stamping).

Introduce a new function gs_usb_get_minimum_length() and check that we have at least received the required amount of data before accessing it. Only copy the data to that skb that has actually been received.

[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68342",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "lessThan": "4ffac725154cf6a253f5e6aa0c8946232b6a0af5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "lessThan": "ad55004a3cb5b41ef78aa6c09e7bc5a489ba652b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "lessThan": "fb0c7c77a7ae3a2c3404b7d0173b8739a754b513",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "lessThan": "395d988f93861101ec89d0dd9e3b876ae9392a5b",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/can/usb/gs_usb.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.61",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.11",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/can/usb/gs_usb.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-23T14:16:40.810",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/395d988f93861101ec89d0dd9e3b876ae9392a5b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4ffac725154cf6a253f5e6aa0c8946232b6a0af5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ad55004a3cb5b41ef78aa6c09e7bc5a489ba652b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fb0c7c77a7ae3a2c3404b7d0173b8739a754b513",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data\n\nThe URB received in gs_usb_receive_bulk_callback() contains a struct\ngs_host_frame. The length of the data after the header depends on the\ngs_host_frame hf::flags and the active device features (e.g. time\nstamping).\n\nIntroduce a new function gs_usb_get_minimum_length() and check that we have\nat least received the required amount of data before accessing it. Only\ncopy the data to that skb that has actually been received.\n\n[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]"
    }
  ],
  "lastModified": "2026-06-17T09:58:58.183",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}