CVE-2025-68288 (GCVE-0-2025-68288)
Vulnerability from cvelistv5 – Published: 2025-12-16 15:06 – Updated: 2025-12-16 15:06
VLAI?
Title
usb: storage: Fix memory leak in USB bulk transport
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: Fix memory leak in USB bulk transport
A kernel memory leak was identified by the 'ioctl_sg01' test from Linux
Test Project (LTP). The following bytes were mainly observed: 0x53425355.
When USB storage devices incorrectly skip the data phase with status data,
the code extracts/validates the CSW from the sg buffer, but fails to clear
it afterwards. This leaves status protocol data in srb's transfer buffer,
such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can
lead to USB protocols leaks to user space through SCSI generic (/dev/sg*)
interfaces, such as the one seen here when the LTP test requested 512 KiB.
Fix the leak by zeroing the CSW data in srb's transfer buffer immediately
after the validation of devices that skip data phase.
Note: Differently from CVE-2018-1000204, which fixed a big leak by zero-
ing pages at allocation time, this leak occurs after allocation, when USB
protocol data is written to already-allocated sg pages.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
a45b599ad808c3c982fdcdc12b0b8611c2f92824 , < 83f0241959831586d9b6d47f6bd5d3dec8f43bf0
(git)
Affected: a45b599ad808c3c982fdcdc12b0b8611c2f92824 , < 4ba515dfff7eeca369ab85cdbb3f3b231c71720c (git) Affected: a45b599ad808c3c982fdcdc12b0b8611c2f92824 , < 467fec3cefbeb9e3ea80f457da9a5666a71ca0d0 (git) Affected: a45b599ad808c3c982fdcdc12b0b8611c2f92824 , < cb1401b5bcc2feb5b038fc4b512e5968b016e05e (git) Affected: a45b599ad808c3c982fdcdc12b0b8611c2f92824 , < 0f18eac44c5668204bf6eebb01ddb369ac56932b (git) Affected: a45b599ad808c3c982fdcdc12b0b8611c2f92824 , < 5b815ddb3f5560fac35b16de3a2a22d5f81c5993 (git) Affected: a45b599ad808c3c982fdcdc12b0b8611c2f92824 , < 41e99fe2005182139b1058db71f0d241f8f0078c (git) Affected: 582802e7c617cfb07cc15f280c128e6decbc57b8 (git) Affected: 58b7ce6f9ef2367f86384b20458642945993b816 (git) Affected: 93314640426ddb6af618d0802e622f6fa771792c (git) Affected: ad2518320bc440ed3db072e2444a1bb226a9cf7a (git) Affected: d827bea2d18c07ba514f7d48cde49f90da9a1384 (git) Affected: 39169410574503c6e901de1aa6eac5108475e017 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/storage/transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "83f0241959831586d9b6d47f6bd5d3dec8f43bf0",
"status": "affected",
"version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"versionType": "git"
},
{
"lessThan": "4ba515dfff7eeca369ab85cdbb3f3b231c71720c",
"status": "affected",
"version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"versionType": "git"
},
{
"lessThan": "467fec3cefbeb9e3ea80f457da9a5666a71ca0d0",
"status": "affected",
"version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"versionType": "git"
},
{
"lessThan": "cb1401b5bcc2feb5b038fc4b512e5968b016e05e",
"status": "affected",
"version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"versionType": "git"
},
{
"lessThan": "0f18eac44c5668204bf6eebb01ddb369ac56932b",
"status": "affected",
"version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"versionType": "git"
},
{
"lessThan": "5b815ddb3f5560fac35b16de3a2a22d5f81c5993",
"status": "affected",
"version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"versionType": "git"
},
{
"lessThan": "41e99fe2005182139b1058db71f0d241f8f0078c",
"status": "affected",
"version": "a45b599ad808c3c982fdcdc12b0b8611c2f92824",
"versionType": "git"
},
{
"status": "affected",
"version": "582802e7c617cfb07cc15f280c128e6decbc57b8",
"versionType": "git"
},
{
"status": "affected",
"version": "58b7ce6f9ef2367f86384b20458642945993b816",
"versionType": "git"
},
{
"status": "affected",
"version": "93314640426ddb6af618d0802e622f6fa771792c",
"versionType": "git"
},
{
"status": "affected",
"version": "ad2518320bc440ed3db072e2444a1bb226a9cf7a",
"versionType": "git"
},
{
"status": "affected",
"version": "d827bea2d18c07ba514f7d48cde49f90da9a1384",
"versionType": "git"
},
{
"status": "affected",
"version": "39169410574503c6e901de1aa6eac5108475e017",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/storage/transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.247",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.197",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.119",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.247",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.197",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.159",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.119",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.61",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.11",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.133",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: Fix memory leak in USB bulk transport\n\nA kernel memory leak was identified by the \u0027ioctl_sg01\u0027 test from Linux\nTest Project (LTP). The following bytes were mainly observed: 0x53425355.\n\nWhen USB storage devices incorrectly skip the data phase with status data,\nthe code extracts/validates the CSW from the sg buffer, but fails to clear\nit afterwards. This leaves status protocol data in srb\u0027s transfer buffer,\nsuch as the US_BULK_CS_SIGN \u0027USBS\u0027 signature observed here. Thus, this can\nlead to USB protocols leaks to user space through SCSI generic (/dev/sg*)\ninterfaces, such as the one seen here when the LTP test requested 512 KiB.\n\nFix the leak by zeroing the CSW data in srb\u0027s transfer buffer immediately\nafter the validation of devices that skip data phase.\n\nNote: Differently from CVE-2018-1000204, which fixed a big leak by zero-\ning pages at allocation time, this leak occurs after allocation, when USB\nprotocol data is written to already-allocated sg pages."
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T15:06:09.654Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/83f0241959831586d9b6d47f6bd5d3dec8f43bf0"
},
{
"url": "https://git.kernel.org/stable/c/4ba515dfff7eeca369ab85cdbb3f3b231c71720c"
},
{
"url": "https://git.kernel.org/stable/c/467fec3cefbeb9e3ea80f457da9a5666a71ca0d0"
},
{
"url": "https://git.kernel.org/stable/c/cb1401b5bcc2feb5b038fc4b512e5968b016e05e"
},
{
"url": "https://git.kernel.org/stable/c/0f18eac44c5668204bf6eebb01ddb369ac56932b"
},
{
"url": "https://git.kernel.org/stable/c/5b815ddb3f5560fac35b16de3a2a22d5f81c5993"
},
{
"url": "https://git.kernel.org/stable/c/41e99fe2005182139b1058db71f0d241f8f0078c"
}
],
"title": "usb: storage: Fix memory leak in USB bulk transport",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68288",
"datePublished": "2025-12-16T15:06:09.654Z",
"dateReserved": "2025-12-16T14:48:05.292Z",
"dateUpdated": "2025-12-16T15:06:09.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-68288\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T16:16:07.620\",\"lastModified\":\"2025-12-18T15:08:06.237\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: storage: Fix memory leak in USB bulk transport\\n\\nA kernel memory leak was identified by the \u0027ioctl_sg01\u0027 test from Linux\\nTest Project (LTP). The following bytes were mainly observed: 0x53425355.\\n\\nWhen USB storage devices incorrectly skip the data phase with status data,\\nthe code extracts/validates the CSW from the sg buffer, but fails to clear\\nit afterwards. This leaves status protocol data in srb\u0027s transfer buffer,\\nsuch as the US_BULK_CS_SIGN \u0027USBS\u0027 signature observed here. Thus, this can\\nlead to USB protocols leaks to user space through SCSI generic (/dev/sg*)\\ninterfaces, such as the one seen here when the LTP test requested 512 KiB.\\n\\nFix the leak by zeroing the CSW data in srb\u0027s transfer buffer immediately\\nafter the validation of devices that skip data phase.\\n\\nNote: Differently from CVE-2018-1000204, which fixed a big leak by zero-\\ning pages at allocation time, this leak occurs after allocation, when USB\\nprotocol data is written to already-allocated sg pages.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f18eac44c5668204bf6eebb01ddb369ac56932b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/41e99fe2005182139b1058db71f0d241f8f0078c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/467fec3cefbeb9e3ea80f457da9a5666a71ca0d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4ba515dfff7eeca369ab85cdbb3f3b231c71720c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5b815ddb3f5560fac35b16de3a2a22d5f81c5993\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83f0241959831586d9b6d47f6bd5d3dec8f43bf0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cb1401b5bcc2feb5b038fc4b512e5968b016e05e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…