VYPR
← All advisories
High severity7.8NVD Advisory· Published Feb 22, 2025· Updated May 12, 2026

CVE-2025-21704

CVE-2025-21704

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdc-acm: Check control transfer buffer size before access

If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing expected_size - acm->nb_index to wrap.

This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications").

A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

80

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.