https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:47:05 +0000 https://vulnerability.circl.lu/vuln/cve-2025-68288 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>usb: storage: Fix memory leak in USB bulk transport</p> <p>A kernel memory leak was identified by the &#39;ioctl_sg01&#39; test from Linux Test Project (LTP). The following bytes were mainly observed: 0x53425355.</p> <p>When USB storage devices incorrectly skip the data phase with status data, the code extracts/validates the CSW from the sg buffer, but fails to clear it afterwards. This leaves status protocol data in srb&#39;s transfer buffer, such as the US_BULK_CS_SIGN &#39;USBS&#39; signature observed here. Thus, this can lead to USB protocols leaks to user space through SCSI generic (/dev/sg*) interfaces, such as the one seen here when the LTP test requested 512 KiB.</p> <p>Fix the leak by zeroing the CSW data in srb&#39;s transfer buffer immediately after the validation of devices that skip data phase.</p> <p>Note: Differently from CVE-2018-1000204, which fixed a big leak by zero- ing pages at allocation time, this leak occurs after allocation, when USB protocol data is written to already-allocated sg pages.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>usb: storage: Fix memory leak in USB bulk transport</p> <p>A kernel memory leak was identified by the &#39;ioctl_sg01&#39; test from Linux Test Project (LTP). The following bytes were mainly observed: 0x53425355.</p> <p>When USB storage devices incorrectly skip the data phase with status data, the code extracts/validates the CSW from the sg buffer, but fails to clear it afterwards. This leaves status protocol data in srb&#39;s transfer buffer, such as the US_BULK_CS_SIGN &#39;USBS&#39; signature observed here. Thus, this can lead to USB protocols leaks to user space through SCSI generic (/dev/sg*) interfaces, such as the one seen here when the LTP test requested 512 KiB.</p> <p>Fix the leak by zeroing the CSW data in srb&#39;s transfer buffer immediately after the validation of devices that skip data phase.</p> <p>Note: Differently from CVE-2018-1000204, which fixed a big leak by zero- ing pages at allocation time, this leak occurs after allocation, when USB protocol data is written to already-allocated sg pages.</p> https://vulnerability.circl.lu/vuln/cve-2025-68288