CVE-2025-68734: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68734 is a memory leak vulnerability in the Linux kernel's ISDN mISDN hfcsusb driver, specifically within the hfcsusb_probe() function. When setup_instance() fails with an error code, the memory allocated for ctrl_urb is not freed before the hw structure is released, resulting in a kernel memory leak. The vulnerability was discovered via a prototype static analysis tool and disclosed on December 24, 2025. It affects Linux kernel versions from 2.6.29 up to the patched stable releases. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, ENISA EUVD).

The root cause is a missing resource deallocation on error paths in hfcsusb_probe() (CWE-401: Missing Release of Memory after Effective Lifetime). When the USB URB (ctrl_urb) is allocated and subsequently setup_instance() returns an error, the code path fails to call usb_free_urb() before freeing the hw structure, leaking kernel memory. The fix restructures the error paths using a goto-ladder pattern to ensure proper cleanup ordering. The issue was identified through static analysis rather than dynamic exploitation, and no public proof-of-concept exploit code is known (Feedly, kernel.org patches).

The primary impact is a kernel memory leak in systems using the hfcsusb ISDN USB adapter driver, which could gradually exhaust kernel memory resources over time if the vulnerable probe path is triggered repeatedly (e.g., by repeatedly attaching and detaching the affected USB device). This could degrade system stability and availability, potentially leading to a denial-of-service condition. Confidentiality and integrity impacts are not directly associated with this vulnerability, and there is no known path to privilege escalation or code execution (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-68734. The vulnerability requires local access to trigger the affected code path (physical or logical attachment of an hfcsusb-compatible USB ISDN device). The EPSS score is 0.024% (0.000240), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.59, 6.17.9, and 6.18. Users should update to the appropriate patched stable kernel release for their distribution. Oracle Linux users can refer to advisories ELISA-2026-50100, ELISA-2026-50113, ELISA-2026-50134, and ELISA-2026-50142 for distribution-specific updates. As a temporary workaround, systems that do not use hfcsusb ISDN USB hardware can blacklist the hfcsusb kernel module to prevent the vulnerable code from executing (Feedly, ENISA EUVD).