CVE-2025-68217 Input: pegasus-notetaker - fix potential out-of-bounds access
A malicious USB device can trigger an out-of-bounds memory access in the Linux kernel pegasus-notetaker driver, potentially leading to code execution or system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-68217?
CVE-2025-68217 is a memory corruption vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Input: pegasus-notetaker - fix potential out-of-bounds access
In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer.
Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access.
Which versions are affected by CVE-2025-68217?
How do I fix CVE-2025-68217?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-68217 being exploited?
There is no known exploitation of CVE-2025-68217 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68217, DEBIAN-CVE-2025-68217, GHSA-6r4f-cg5f-j3p5, ROOT-OS-DEBIAN-12-CVE-2025-68217, ROOT-OS-DEBIAN-13-CVE-2025-68217, ROOT-OS-UBUNTU-2204-CVE-2025-68217 and 2 more.