CVE-2025-68308: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68308 is a denial-of-service vulnerability in the Linux kernel's Kvaser USB CAN bus (leaf) driver caused by a potential infinite loop in command parsing logic. The flaw exists in the kvaser_usb_leaf_wait_cmd() and kvaser_usb_leaf_read_bulk_callback functions, which fail to correctly advance the buffer position when a zero-length command is encountered exactly on a USB packet boundary. It affects Linux kernel versions from 4.19 through those prior to the patched releases (5.10.247, 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18). The vulnerability was published on December 16, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is an off-by-one logic error (CWE-835: Loop with Unreachable Exit Condition) in the Kvaser USB leaf driver's command parsing routines. Zero-length commands are used as padding to align data to the USB endpoint's wMaxPacketSize boundary; the driver skips them by calling round_up(pos, wMaxPacketSize). However, when pos is already a multiple of wMaxPacketSize (including 0), round_up() returns the same value, leaving pos unchanged and causing an infinite loop. The fix replaces round_up(pos, ...) with round_up(pos + 1, ...), ensuring the position always advances to the next boundary. Exploitation requires local access and low privileges — an attacker or malicious device must be able to cause the kernel to process USB CAN data containing a zero-length command at a packet boundary (Feedly).

Successful exploitation results in a denial of service: the affected kernel parsing function enters an infinite loop, hanging CAN bus interface operations and potentially freezing related system processes. The impact is limited to availability (no confidentiality or integrity loss), but systems relying on CAN bus communication — such as industrial control, automotive, or embedded systems using Kvaser USB CAN adapters — could experience significant operational disruption. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and physical or logical access to a Kvaser USB CAN device (Feedly).

Update to a patched Linux kernel version: 5.10.247, 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, or 6.18. Microsoft has also released a patch for Azure Linux 3 (azl3_kernel_6.6.117.1-1) as of December 17, 2025. Ubuntu has issued security notices USN-8094-x, USN-8096-x, USN-8116-1, USN-8152-1, and related advisories covering affected kernel packages. As a temporary workaround for systems that cannot be immediately patched, restrict local user access and disable or unload the kvaser_usb kernel module if Kvaser USB CAN devices are not required (modprobe -r kvaser_usb) (Feedly, Microsoft MSRC, Ubuntu USN-8094-1).