CVE-2025-68289

Vulnerability

In the bug

In the Linux kernel's USB gadget subsystem, the eem_unwrap function driver (f_eem) implements the Ethernet Emulation Model (EEM) protocol. The eem_unwrap function processes incoming USB requests and, in the command path, allocates several resources: a cloned skb, a USB request via usb_ep_alloc_request, and additional buffers. If the subsequent usb_ep_queue` call fails, the existing code did not free these allocated resources, leading to a memory leak [1][2][3].

Exploitation

This vulnerability is triggered during normal USB gadget operation when a USB request submission fails. No special privileges are required beyond the ability to interact with the USB gadget device; the attacker would be needed to trigger the failure condition. The leak occurs in kernel memory and can be observed via kmemleak, which reported multiple unreferenced objects of sizes 240, 256, 128, and 64 bytes [1].

Impact

An attacker who can cause repeated usb_ep_queue failures in the EEM command path could exhaust kernel memory, leading to a denial-of-service (DoS) condition. The leak is per-leak amount is modest, but sustained exploitation could degrade system stability or availability.

Mitigation

The fix improves error handling by using goto-based cleanup to free all allocated resources on usb_ep_queue failure. The patch has been applied to the stable kernel tree [1][2][3]. Users should update to a kernel version containing the commit to remediate the issue.