CVE-2025-68217: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68217 is an out-of-bounds memory access vulnerability in the Linux kernel's pegasus-notetaker USB input driver. The flaw resides in the pegasus_probe() function, which allocates a URB transfer buffer based on the wMaxPacketSize value from the USB endpoint descriptor — a value that can be manipulated via a malicious USB device to force an undersized allocation. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from 4.8 up to the patched releases. It carries a CVSS v3.1 base score of 6.2 (Medium) (Feedly, Microsoft MSRC).

The root cause is classified as an out-of-bounds read/write (CWE-125/CWE-787) triggered by insufficient bounds checking in the pegasus_parse_packet() function. When a USB device sends an interrupt packet whose first byte is 0x80 or 0x42, the driver parses the packet data without validating it against the actual allocated buffer size, which may have been forced to a very small value by a crafted wMaxPacketSize in the USB descriptor. Exploitation requires physical access to connect a malicious USB device (attack vector: Local), and no privileges are required on the host system. The vulnerability is introduced at commit 1afca2b66aac7ac262d3511c68725e9e7053b40f and is fixed in multiple stable kernel branches (Feedly).

Successful exploitation results in an out-of-bounds memory access that can cause kernel crashes or system instability, leading to a denial of service (availability impact: High). There is no assessed confidentiality or integrity impact, as the primary consequence is system unavailability. Affected systems include any Linux host running a vulnerable kernel version (prior to 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, or 6.18) that has the pegasus-notetaker driver loaded and accepts USB connections from untrusted sources (Feedly).

1. Preparation: Obtain or craft a malicious USB device (e.g., using a programmable USB microcontroller such as a Facedancer or similar hardware) capable of presenting a custom USB descriptor with a manipulated wMaxPacketSize value set to a very small number (e.g., 1 or 2 bytes).
2. Physical Access: Connect the malicious USB device to a target Linux system running a vulnerable kernel version with the pegasus-notetaker driver loaded or auto-loadable.
3. Trigger Small Buffer Allocation: The kernel's pegasus_probe() function reads wMaxPacketSize from the device descriptor and allocates the URB transfer buffer accordingly — resulting in an undersized buffer.
4. Send Malicious Interrupt Packet: Program the USB device to send an interrupt packet where the first byte is 0x80 or 0x42, triggering the pegasus_parse_packet() function to parse packet data beyond the allocated buffer boundary.
5. Achieve Denial of Service: The out-of-bounds memory access causes a kernel panic or system crash, resulting in denial of service on the target host (Feedly).

• Physical: Unrecognized or suspicious USB device connected to a system running the pegasus-notetaker driver.
• Logs: Kernel panic messages or oops traces in /var/log/kern.log or dmesg referencing pegasus_parse_packet or pegasus_notetaker; messages such as BUG: KASAN: out-of-bounds or general protection fault associated with the pegasus driver.
• Process/System: Unexpected system reboots or kernel crashes; dmesg output showing USB device enumeration events followed immediately by kernel errors.
• File System: Core dump files generated around the time of USB device connection events.

Patches are available in the following Linux kernel stable releases: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, and 6.18. Microsoft has released an update for azl3_kernel_6.6.117.1-1. Distribution-specific updates have been issued by Debian (DLA-4436-1), Ubuntu (USN-8094-x, USN-8096-x, USN-8116-1, USN-8152-1), and others. As a workaround, administrators should blacklist the pegasus kernel module (echo 'blacklist pegasus' >> /etc/modprobe.d/blacklist.conf) if the Pegasus Notetaker device is not in use, and implement physical USB port controls on sensitive systems to prevent connection of untrusted USB devices (Feedly, Microsoft MSRC).