CVE-2025-68750: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68750 is a potential integer overflow vulnerability in the Linux kernel's USB gadget subsystem, specifically in the usbg_make_tpg() function. The flaw arises because the local variable tpgt is declared as unsigned long but is assigned to tpgt->tport_tpgt, which is a u16 (16-bit unsigned integer). When tpgt exceeds USHRT_MAX (65535), the truncation during assignment can cause an integer overflow, potentially leading to memory corruption or unexpected behavior. The vulnerability was disclosed on December 24, 2025, and affects the Linux kernel across a wide range of stable versions. Feedly estimates the severity as HIGH, with an EPSS score of approximately 0.024% (Red Hat CVE, ENISA EUVD).

The root cause is an integer truncation/overflow (CWE-190) in the usbg_make_tpg() function within the Linux kernel's USB gadget target driver. When a caller supplies a tpgt value larger than 65535, the unsigned long value is silently truncated upon assignment to the u16 field tport_tpgt, producing an incorrect (wrapped) value. This is analogous to the previously fixed issue in commit 59c816c1f24d ("vhost/scsi: potential memory corruption"). The fix changes the type of the local tpgt variable to u16 to match the destination field, preventing the overflow condition. Exploitation would require the ability to invoke usbg_make_tpg() with a crafted large tpgt argument, which typically requires local or privileged access to USB gadget configuration interfaces (Red Hat CVE, ENISA EUVD).

Successful exploitation could result in memory corruption due to the integer overflow, potentially causing system instability, kernel panics (denial of service), or in more severe scenarios, arbitrary code execution within the kernel context. The affected component is the USB gadget target subsystem, so impact is primarily limited to systems that expose USB gadget functionality (e.g., embedded devices, systems acting as USB peripherals). Lateral movement potential is limited, but kernel-level code execution would grant an attacker full control over the affected system (ENISA EUVD, Red Hat CVE).

Patches have been released for multiple Linux kernel stable branches. Administrators should update to one of the following fixed versions: 5.4.296, 5.10.240, 5.15.187, 6.1.143, 6.6.96, 6.12.36, 6.15.5, or 6.16. As a workaround where patching is not immediately possible, restricting access to USB gadget configuration interfaces (e.g., via ConfigFS permissions) can reduce exposure. Monitoring and validating input parameters for USB-related kernel interfaces is also recommended (Red Hat CVE, ENISA EUVD).

The vulnerability received routine coverage from vulnerability tracking services including VulnDB, CIRCL, and CVEFeed shortly after disclosure on December 24, 2025. Red Hat filed a Bugzilla entry (bug #2425218) and published a CVE advisory. No notable researcher commentary or significant social media discussion beyond automated CVE tracking posts has been identified (Red Hat Bugzilla, ENISA EUVD).