CVE-2025-68217

Vulnerability

Description

In the Linux kernel's pegasus_notetaker input driver, the pegasus_probe() function allocates a URB transfer buffer based on the wMaxPacketSize value from the USB endpoint descriptor. An attacker with physical access can plug in a malicious USB device that advertises a very small wMaxPacketSize, causing the kernel to allocate an undersized buffer. Subsequently, when the device sends an interrupt packet where the first byte is 0x80 or 0x42, the pegasus_parse_packet() function parses the packet without verifying that the received data fits within the allocated buffer, leading to an out-of-bounds read or write [1][2][3].

Exploitation

The attack requires an attacker to have physical access to the target system and the ability to connect a malicious USB device. specially crafted USB device. No authentication is needed beyond the ability to insert a USB device. The vulnerability is triggered during normal USB interrupt handling, meaning the attacker does not need to interact with the system beyond plugging in the malicious device.

Impact

A successful out-of-bounds access can corrupt kernel memory, potentially sensitive kernel memory, leading to a system crash (denial of service) or, in more severe cases, arbitrary code execution with kernel privileges. This could allow an attacker to fully compromise the affected system.

Mitigation

The vulnerability has been patched in the Linux kernel stable releases. The fix adds proper bounds checking in pegasus_parse_packet() to ensure the received packet does not exceed the allocated buffer size. Users should apply the relevant stable kernel updates to mitigate this issue.