CVE-2025-68308

In the Linux kernel's kvaser_usb leaf driver, functions kvaser_usb_leaf_wait_cmd() and kvaser_usb_leaf_read_bulk_callback handle zero-length commands used for alignment to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip these placeholders by aligning position pos using round_up(). However, if a zero-length command is exactly on a packet boundary, round_up returns the same value, preventing progression and causing an infinite loop [1][2].

Exploitation requires an attacker to be able to send crafted USB packets to a system using the vulnerable driver. This could be achieved by plugging in a malicious USB device or via a compromised USB hub. No authentication is needed, as the driver processes packets from any connected device. The infinite loop occurs in kernel context, effectively hanging the parsing routine.

The impact is a denial of service. The infinite loop consumes CPU resources and prevents further processing of CAN commands, potentially freezing the CAN interface or the entire system if the loop ties up critical kernel threads.

The fix, as committed in [1] and [2], addresses the issue by using pos + 1 in the round_up calculation to ensure the position always advances to the next boundary. The patched versions are available as part of Linux kernel updates. Users should apply the latest stable kernel updates to mitigate.