CVE-2025-68194: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68194 is a vulnerability in the Linux kernel's imon media driver (located in drivers/media/rc/) that can result in hung tasks due to improper handling of USB error conditions. The root cause is a poor error-recovery scheme in send_packet() and the USB RX callback functions: when usb_rx_callback_intf0() encounters a -EPROTO error, it resubmits the URB indefinitely, causing printk flooding and potential RCU stalls that permanently hold the device lock. The vulnerability was published on December 16, 2025, and affects multiple stable Linux kernel versions. It carries a low EPSS score of 0.000240, indicating minimal current exploitation probability (CVE Record, Feedly).

The vulnerability is classified under improper error handling (CWE-755) in the Linux kernel's imon USB IR/VFD receiver driver. When the USB RX callback (usb_rx_callback_intf0) receives a -EPROTO error after ictx->dev_present_intf0 is set to true, it unconditionally resubmits the URB, creating an infinite retry loop that floods the kernel log and causes RCU stalls. This results in the device lock being held indefinitely, leading to hung tasks. The fix involves limiting retries to specific error codes (drawn from other drivers/media/rc/ modules that handle -EPROTO) rather than retrying on all errors, breaking the infinite loop. The issue was identified by syzbot fuzzing (CVE Record).

Successful triggering of this vulnerability causes a local denial-of-service condition: the kernel's imon driver enters an infinite URB resubmission loop, flooding the kernel log with printk messages, inducing RCU stalls, and permanently holding the device lock, which results in hung tasks. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The affected scope is limited to systems with an imon USB IR/VFD device attached and running a vulnerable kernel version (CVE Record, Feedly).

The Linux kernel maintainers have released patches across multiple stable branches, referenced by commits 26f6a1dd5d81, 0213e4175abb, 667afd468178, 8231e8011846, and 519737af11c0 on kernel.org. Downstream distributions including Debian (DLA-4436-1 for Linux 6.1), Ubuntu (USN-8096-1, USN-8096-2, USN-8096-3, USN-8096-5), and Oracle Linux (ELISA-2026-50100, ELISA-2026-50113, ELISA-2026-50134, ELISA-2026-50142) have issued updated kernel packages. Users should update to the patched kernel version provided by their distribution as soon as possible (Debian LTS, Ubuntu USN-8096-1).

The vulnerability was identified through syzbot (Google's kernel fuzzing infrastructure), and the fix was reviewed with input from USB subsystem maintainer Alan Stern, who provided guidance on acceptable URB error-recovery strategies. Downstream Linux distributions (Debian, Ubuntu, Oracle Linux) have incorporated the fix into their kernel update advisories. No significant broader media coverage or social media discussion has been observed (Debian LTS, Ubuntu USN-8096-1).