Junglewise Threat Intelligence

CVE-2025-21704: Linux Kernel memory corruption in usb cdc-acm driver

CVE-2025-21704 · Severity: high · CVSS 7.8 · Published 2025-02-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB modem driver could allow a malicious or compromised USB device to cause system instability or memory corruption. This occurs when the system processes specially crafted communication signals from a USB device, such as a modem. While an attacker typically needs physical access to plug in a device, automated system tools like ModemManager may automatically trigger the vulnerable code when a device is connected.

Technical details

A heap-based out-of-bounds write vulnerability exists in the Linux kernel's USB CDC-ACM driver (drivers/usb/class/cdc-acm.c). The root cause is a failure to verify that the first fragment of a notification is at least as large as 'struct usb_cdc_notification' before accessing its header fields. An attacker providing a truncated first fragment can cause the driver to read lengths from out-of-bounds memory, leading to an integer wrap when calculating 'expected_size - acm->nb_index'. This results in memory corruption during the reassembly of fragmented notifications. The vulnerability is reachable locally when a USB device is opened, which may happen automatically via ModemManager. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel versions from 2.6.13 up to 5.4.291; 5.5 up to 5.10.235; 5.11 up to 5.15.179; 5.16 up to 6.1.129; 6.2 up to 6.6.79; 6.7 up to 6.12.16; 6.13 up to 6.13.4

Timeline

  • 2025-02-12: patched: Initial patch authored by Google Project Zero
  • 2025-02-21: patched: Patches committed to stable kernel trees
  • 2025-02-22: advisory: CVE published

References

Related threats