CVE-2025-68217

NameCVE-2025-68217
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)bullseye5.10.223-1vulnerable
bullseye (security)5.10.247-1fixed
bookworm6.1.148-1vulnerable
bookworm (security)6.1.158-1vulnerable
trixie6.12.57-1vulnerable
trixie (security)6.12.48-1vulnerable
forky6.17.11-1fixed
sid6.17.12-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcebullseye5.10.247-1
linuxsource(unstable)6.17.10-1

Notes

https://git.kernel.org/linus/69aeb507312306f73495598a055293fa749d454e (6.18-rc7)

Search for package or bug name: Reporting problems