FKIE_CVE-2025-68288

Vulnerability from fkie_nvd - Published: 2025-12-16 16:16 - Updated: 2026-10-13 19:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctl_sg01' test from Linux Test Project (LTP). The following bytes were mainly observed: 0x53425355. When USB storage devices incorrectly skip the data phase with status data, the code extracts/validates the CSW from the sg buffer, but fails to clear it afterwards. This leaves status protocol data in srb's transfer buffer, such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can lead to USB protocols leaks to user space through SCSI generic (/dev/sg*) interfaces, such as the one seen here when the LTP test requested 512 KiB. Fix the leak by zeroing the CSW data in srb's transfer buffer immediately after the validation of devices that skip data phase. Note: Differently from CVE-2018-1000204, which fixed a big leak by zero- ing pages at allocation time, this leak occurs after allocation, when USB protocol data is written to already-allocated sg pages.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0f18eac44c5668204bf6eebb01ddb369ac56932b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/41e99fe2005182139b1058db71f0d241f8f0078c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/467fec3cefbeb9e3ea80f457da9a5666a71ca0d0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4ba515dfff7eeca369ab85cdbb3f3b231c71720c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5b815ddb3f5560fac35b16de3a2a22d5f81c5993
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/83f0241959831586d9b6d47f6bd5d3dec8f43bf0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cb1401b5bcc2feb5b038fc4b512e5968b016e05e
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/storage/transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83f0241959831586d9b6d47f6bd5d3dec8f43bf0",
              "status": "affected",
              "version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
              "versionType": "git"
            },
            {
              "lessThan": "4ba515dfff7eeca369ab85cdbb3f3b231c71720c",
              "status": "affected",
              "version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
              "versionType": "git"
            },
            {
              "lessThan": "467fec3cefbeb9e3ea80f457da9a5666a71ca0d0",
              "status": "affected",
              "version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
              "versionType": "git"
            },
            {
              "lessThan": "cb1401b5bcc2feb5b038fc4b512e5968b016e05e",
              "status": "affected",
              "version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
              "versionType": "git"
            },
            {
              "lessThan": "0f18eac44c5668204bf6eebb01ddb369ac56932b",
              "status": "affected",
              "version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
              "versionType": "git"
            },
            {
              "lessThan": "5b815ddb3f5560fac35b16de3a2a22d5f81c5993",
              "status": "affected",
              "version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
              "versionType": "git"
            },
            {
              "lessThan": "41e99fe2005182139b1058db71f0d241f8f0078c",
              "status": "affected",
              "version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "582802e7c617cfb07cc15f280c128e6decbc57b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58b7ce6f9ef2367f86384b20458642945993b816",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "93314640426ddb6af618d0802e622f6fa771792c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ad2518320bc440ed3db072e2444a1bb226a9cf7a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d827bea2d18c07ba514f7d48cde49f90da9a1384",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "39169410574503c6e901de1aa6eac5108475e017",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.58",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.110",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.133",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.103",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/storage/transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: Fix memory leak in USB bulk transport\n\nA kernel memory leak was identified by the \u0027ioctl_sg01\u0027 test from Linux\nTest Project (LTP). The following bytes were mainly observed: 0x53425355.\n\nWhen USB storage devices incorrectly skip the data phase with status data,\nthe code extracts/validates the CSW from the sg buffer, but fails to clear\nit afterwards. This leaves status protocol data in srb\u0027s transfer buffer,\nsuch as the US_BULK_CS_SIGN \u0027USBS\u0027 signature observed here. Thus, this can\nlead to USB protocols leaks to user space through SCSI generic (/dev/sg*)\ninterfaces, such as the one seen here when the LTP test requested 512 KiB.\n\nFix the leak by zeroing the CSW data in srb\u0027s transfer buffer immediately\nafter the validation of devices that skip data phase.\n\nNote: Differently from CVE-2018-1000204, which fixed a big leak by zero-\ning pages at allocation time, this leak occurs after allocation, when USB\nprotocol data is written to already-allocated sg pages."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: almacenamiento: Correcci\u00f3n de fuga de memoria en el transporte masivo USB\n\nUna fuga de memoria del kernel fue identificada por la prueba \u0027ioctl_sg01\u0027 del Proyecto de Pruebas de Linux (LTP). Los siguientes bytes fueron observados principalmente: 0x53425355.\n\nCuando los dispositivos de almacenamiento USB omiten incorrectamente la fase de datos con datos de estado, el c\u00f3digo extrae/valida el CSW del b\u00fafer sg, pero no lo borra despu\u00e9s. Esto deja datos de protocolo de estado en el b\u00fafer de transferencia de srb, como la firma US_BULK_CS_SIGN \u0027USBS\u0027 observada aqu\u00ed. As\u00ed, esto puede llevar a fugas de protocolos USB al espacio de usuario a trav\u00e9s de interfaces SCSI gen\u00e9ricas (/dev/sg), como la vista aqu\u00ed cuando la prueba LTP solicit\u00f3 512 KiB.\n\nSe corrige la fuga poniendo a cero los datos CSW en el b\u00fafer de transferencia de srb inmediatamente despu\u00e9s de la validaci\u00f3n de los dispositivos que omiten la fase de datos.\n\nNota: A diferencia de CVE-2018-1000204, que corrigi\u00f3 una gran fuga poniendo a cero p\u00e1ginas en el momento de la asignaci\u00f3n, esta fuga ocurre despu\u00e9s de la asignaci\u00f3n, cuando los datos del protocolo USB son escritos en p\u00e1ginas sg ya asignadas."
    }
  ],
  "id": "CVE-2025-68288",
  "lastModified": "2026-10-13T19:10:00.193",
  "metrics": {},
  "published": "2025-12-16T16:16:07.620",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0f18eac44c5668204bf6eebb01ddb369ac56932b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/41e99fe2005182139b1058db71f0d241f8f0078c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/467fec3cefbeb9e3ea80f457da9a5666a71ca0d0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4ba515dfff7eeca369ab85cdbb3f3b231c71720c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5b815ddb3f5560fac35b16de3a2a22d5f81c5993"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/83f0241959831586d9b6d47f6bd5d3dec8f43bf0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cb1401b5bcc2feb5b038fc4b512e5968b016e05e"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.