CVE-2025-68750

Root

Cause In the Linux kernel's USB gadget target subsystem, the usbg_make_tpg() function declares the tpgt variable as unsigned long but assigns it to tpg->tport_tpgt, which is a u16. This type mismatch can cause an integer overflow when tpgt exceeds the maximum value representable by a u16 (65535). The issue is similar to a previously fixed vulnerability in vhost/scsi (commit 59c816c1f24d) [1].

Exploitability

An attacker with the ability to call usbg_make_tpg() with a crafted large tpgt value could trigger the overflow. In practice, this requires local access or the ability to load and interact with the USB gadget configfs interface. No authentication is explicitly required beyond the ability to issue the relevant configfs operations.

Impact

A successful integer overflow leads to assigning a truncated or unexpected value to the target port group identifier. This can cause memory corruption or unexpected behavior in subsequent operations that rely on tport_tpgt as an index or identifier, potentially leading to a system crash or privilege escalation. The vulnerability was discovered and fixed with a patch that aligns the variable type [1, 2, 3, 4].

Mitigation

The fix has been applied to the Linux kernel stable tree. Affected versions should be updated to include commits from the published patches [1][2][3][4]. Users are advised to apply the latest kernel updates from their distribution.