CVE-2025-68342: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68342 is a vulnerability in the Linux kernel's CAN (Controller Area Network) USB driver (gs_usb) caused by insufficient data length validation in the gs_usb_receive_bulk_callback() function. The flaw was disclosed on December 23, 2025, and affects Linux kernel versions starting from commit d08e973a77d1, with patches available for stable branches 6.6.119, 6.12.61, 6.17.11, and 6.18. Microsoft's Azure Linux 3 kernel (version 6.6.117.1-1) is also listed as an affected product. The vulnerability carries a CVSS v3.1 base score of 5.8 (Medium) per Feedly/Red Hat assessment (Red Hat CVE, MSRC).

The root cause is improper validation of the actual_length field of a USB Request Block (URB) before accessing the data payload in gs_usb_receive_bulk_callback(). The function processes a struct gs_host_frame received over USB bulk transfer; the required data length varies based on hf::flags and active device features such as timestamping, but no minimum-length check was performed prior to the fix. This can lead to out-of-bounds memory access (consistent with CWE-125, Out-of-bounds Read, or related buffer handling weaknesses). The fix introduces gs_usb_get_minimum_rx_length() to compute the minimum required data length and validates actual_length before copying data into the socket buffer (skb) (Red Hat CVE, EUVD). Exploitation requires local access and physical or logical ability to interact with a gs_usb CAN device.

A local attacker with low privileges who can interact with a gs_usb CAN USB device could trigger improper memory access, potentially leading to kernel memory disclosure (confidentiality impact), data corruption (integrity impact), or a kernel crash causing denial of service (high availability impact). The CVSS vector reflects low confidentiality and integrity impact alongside high availability impact, scoped to the local system without privilege escalation beyond the kernel context (Red Hat CVE, Feedly).

Update the Linux kernel to a patched version: 6.6.119, 6.12.61, 6.17.11, or 6.18 (EUVD). For Microsoft Azure Linux 3, apply the updated kernel package azl3_kernel_6.6.117.1-1 or later as referenced in the MSRC advisory (MSRC). As interim mitigations, restrict physical and local access to systems with gs_usb CAN USB devices, implement strict USB device connection policies, and use mandatory access control frameworks (SELinux or AppArmor) to limit USB device permissions.