CVE-2025-68343: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68343 is a vulnerability in the Linux kernel's CAN (Controller Area Network) USB driver (gs_usb) where the gs_usb_receive_bulk_callback() function fails to validate the actual_length of received USB bulk transfer data before accessing the header of a gs_host_frame structure. This can result in out-of-bounds memory access when a malformed or truncated URB (USB Request Block) is received. The vulnerability was disclosed on December 23, 2025, and affects Linux kernel versions from the introduction of the gs_usb driver (commit d08e973a77d1) up to the patched releases. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is improper input validation (CWE class: insufficient bounds checking) in the gs_usb_receive_bulk_callback() function of the Linux kernel's drivers/net/can/usb/gs_usb.c. When a USB bulk transfer completes, the driver directly accesses members of the gs_host_frame structure without first verifying that urb->actual_length is large enough to contain the frame header. Additionally, if the URB is too short, the dev pointer derived from the frame data is undefined, and the original code unsafely dereferenced dev->parent->hf_size_rx to resubmit the URB. The fix uses struct_group to define the header portion of gs_host_frame, adds a length check before any member access, and replaces the unsafe pointer chain with parent->hf_size_rx (always valid via urb->context) (kernel.org patch, Red Hat CVE).

Successful exploitation could allow a local attacker with low privileges to trigger kernel memory corruption by submitting a malformed USB bulk transfer to a system with a gs_usb CAN adapter attached. This may result in a kernel panic (denial of service), and in more severe scenarios, could potentially lead to arbitrary code execution in kernel context. Confidentiality impact is assessed as none, while integrity and availability are at risk (Feedly, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access and the presence of a gs_usb CAN-over-USB adapter on the target system, significantly limiting the attack surface (Feedly, Red Hat CVE).

Patches have been released for multiple stable Linux kernel branches: 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18. Administrators should update to the patched kernel version applicable to their distribution as the primary remediation. As a workaround where patching is not immediately possible, restricting physical access to USB ports and blocking untrusted USB devices (e.g., via USBGuard) can reduce exposure. Microsoft has also issued an update for the Azure Linux 3 kernel (azl3_kernel_6.6.117.1-1) (Microsoft MSRC, Feedly).