CVE-2025-68307: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68307 is a resource exhaustion vulnerability in the Linux kernel's CAN (Controller Area Network) gs_usb driver, specifically in the gs_usb_xmit_callback() function. The driver fails to properly clean up failed USB Request Block (URB) transfers, causing the pool of available URBs to shrink by one with each error, ultimately leading to a complete halt of CAN bus transmissions. The vulnerability affects the Linux kernel from version 3.16 onward, with fixes backported to stable branches including 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18. It was published on December 16, 2025, and carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Feedly).

The root cause is improper error handling (CWE-459: Incomplete Cleanup) in the gs_usb_xmit_callback() function of the drivers/net/can/usb/gs_usb.c kernel driver. When a bulk URB transmission fails, the driver does not perform the necessary cleanup steps: it fails to increment netdev statistics, does not mark the echo_skb slot as free, does not release the driver's context or update accounting, and does not wake the send queue. This results in a progressive leak of URB resources — each failed transmission permanently reduces the available URB count by one. A local attacker with low privileges who can interact with a CAN USB interface (e.g., a gs_usb-compatible device) could trigger repeated URB failures to exhaust the resource pool (Red Hat CVE, ENISA EUVD).

Successful exploitation degrades CAN bus network performance progressively and can cause a complete stoppage of all CAN bus transmissions on the affected system. This primarily affects availability of CAN communication interfaces, which are commonly used in industrial control systems, automotive networks, and embedded systems. While confidentiality and integrity impacts are rated High in the CVSS score (reflecting potential for privilege escalation in certain kernel exploitation scenarios), the most direct and observable impact is denial of service to CAN bus communications, which could disrupt critical systems relying on this interface (Red Hat CVE, Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing repeated URB submission errors from the gs_usb driver (e.g., messages referencing gs_usb_xmit_callback with non-zero URB status codes).
• Network: Progressive degradation or complete halt of traffic on CAN network interfaces associated with gs_usb devices; ip -s link show reporting increasing TX errors on the CAN interface.
• Process/System: CAN send queues remaining persistently stopped (netif_stop_queue not followed by netif_wake_queue); candump or similar tools showing no outbound frames despite application-level transmission attempts.

Apply the upstream kernel fix, which has been backported to the following stable kernel versions: 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18. Ubuntu users should apply security notices USN-8094-1 through USN-8094-5 and USN-8152-1 (Ubuntu USN-8094-1, Ubuntu USN-8094-2). Microsoft Azure Linux 3 users should update to kernel version 6.6.117.1-1 or later (Microsoft MSRC). As a temporary workaround, restrict local user access to systems with gs_usb CAN interfaces and monitor CAN bus performance for unexpected degradation. Unloading the gs_usb kernel module (if operationally feasible) will prevent exploitation until patching is complete.