CVE-2025-68343 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
A missing length check in the gs_usb CAN driver allows a local attacker to cause a kernel crash via a short USB packet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68343?
CVE-2025-68343 is a vulnerability in Linux, published on 23 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback().
Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it.
To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short.
Which versions are affected by CVE-2025-68343?
How do I fix CVE-2025-68343?
Apply the vendor's patch.
Is CVE-2025-68343 being exploited?
There is no known exploitation of CVE-2025-68343 in the wild and no public exploit code.
Sources
Also known as AZL-72995, BELL-CVE-2025-68343, DEBIAN-CVE-2025-68343, GHSA-mr5c-58ff-m852, ROOT-OS-DEBIAN-11-CVE-2025-68343, ROOT-OS-DEBIAN-12-CVE-2025-68343 and 4 more.