CVE-2025-68249

Vulnerability

In the Linux kernel's MOST (Media Oriented Systems Transport) USB driver, the hdm_probe() function has an error path that jumps to err_free_mdev before &mdev->dev is initialized via device_initialize(). Calling put_device(&mdev->dev) on an uninitialized device triggers a kernel WARN and invokes kref_put on an uninitialized kobject, leading to undefined behavior [1][2][3].

Exploitation

The bug occurs only in early error handling of the probe function, meaning an attacker would need to trigger a probe failure before device initialization. This requires local access to insert a USB device that triggers the error path, or similar system-level interaction. No authentication is needed beyond physical or logical access to USB ports.

Impact

An attacker exploiting this flaw can cause a kernel warning and potentially corrupt kernel memory due to the uninitialized kobject release, leading to system instability or denial of service. The issue does not directly allow privilege escalation but can be used to crash the system.

Mitigation

The fix, available in stable kernel commits [1][2][3], replaces the put_device() call with a direct kfree() of the private structure, avoiding the uninitialized device release. Users should update to patched kernel versions as soon as possible.