« Volver al listado

CVE-2025-68750

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

usb: potential integer overflow in usbg_make_tpg()

The variable tpgt in usbg_make_tpg() is defined as unsigned long and is assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an integer overflow when tpgt is greater than USHRT_MAX (65535). I haven't tried to trigger it myself, but it is possible to trigger it by calling usbg_make_tpg() with a large value for tpgt.

I modified the type of tpgt to match tpgt->tport_tpgt and adjusted the relevant code accordingly.

This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential memory corruption").

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68750",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "lessThan": "0861b9cb2ff519b7c5a3b1dd52a343e18c4efb24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "lessThan": "603a83e5fee38a950bfcfb2f36449311fa00a474",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "lessThan": "6f77e344515b5258edb3988188311464209b1c7c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "lessThan": "6722e080b5b39ab7471386c73d0c1b39572f943c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "lessThan": "a33f507f36d5881f602dab581ab0f8d22b49762c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "lessThan": "358d5ba08f1609c34a054aed88c431844d09705a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "lessThan": "620a5e1e84a3a7004270703a118d33eeb1c0f368",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "lessThan": "153874010354d050f62f8ae25cbb960c17633dc5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_tcm.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.143",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.96",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_tcm.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-24T16:15:48.687",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0861b9cb2ff519b7c5a3b1dd52a343e18c4efb24",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/153874010354d050f62f8ae25cbb960c17633dc5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/358d5ba08f1609c34a054aed88c431844d09705a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/603a83e5fee38a950bfcfb2f36449311fa00a474",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/620a5e1e84a3a7004270703a118d33eeb1c0f368",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6722e080b5b39ab7471386c73d0c1b39572f943c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6f77e344515b5258edb3988188311464209b1c7c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a33f507f36d5881f602dab581ab0f8d22b49762c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: potential integer overflow in usbg_make_tpg()\n\nThe variable tpgt in usbg_make_tpg() is defined as unsigned long and is\nassigned to tpgt->tport_tpgt, which is defined as u16. This may cause an\ninteger overflow when tpgt is greater than USHRT_MAX (65535). I\nhaven't tried to trigger it myself, but it is possible to trigger it\nby calling usbg_make_tpg() with a large value for tpgt.\n\nI modified the type of tpgt to match tpgt->tport_tpgt and adjusted the\nrelevant code accordingly.\n\nThis patch is similar to commit 59c816c1f24d (\"vhost/scsi: potential\nmemory corruption\")."
    }
  ],
  "lastModified": "2026-06-17T09:59:31.507",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}