CVE-2025-68342

can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

State: Published
Severity: Not scored
Published: Dec 23, 2025
Updated: Oct 30, 2026
Reserved: Dec 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

The URB received in gs_usb_receive_bulk_callback() contains a struct gs_host_frame. The length of the data after the header depends on the gs_host_frame hf::flags and the active device features (e.g. time stamping).

Introduce a new function gs_usb_get_minimum_length() and check that we have at least received the required amount of data before accessing it. Only copy the data to that skb that has actually been received.

[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d08e973a77d128b25e01a08c34d89593fdf222da to before 8376208db9283fbdfaa06c8d80735ac9954fa64aAffected d08e973a77d128b25e01a08c34d89593fdf222da to before 4ffac725154cf6a253f5e6aa0c8946232b6a0af5Affected d08e973a77d128b25e01a08c34d89593fdf222da to before ad55004a3cb5b41ef78aa6c09e7bc5a489ba652bAffected d08e973a77d128b25e01a08c34d89593fdf222da to before fb0c7c77a7ae3a2c3404b7d0173b8739a754b513Affected d08e973a77d128b25e01a08c34d89593fdf222da to before 395d988f93861101ec89d0dd9e3b876ae9392a5bAffected
LinuxLinux	3.16Affected before 3.16Not affected 6.1.191 through 6.1.Not affected 6.6.119 through 6.6.Not affected 6.12.61 through 6.12.Not affected 6.17.11 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

d08e973a77d128b25e01a08c34d89593fdf222da to before 8376208db9283fbdfaa06c8d80735ac9954fa64aAffected
d08e973a77d128b25e01a08c34d89593fdf222da to before 4ffac725154cf6a253f5e6aa0c8946232b6a0af5Affected
d08e973a77d128b25e01a08c34d89593fdf222da to before ad55004a3cb5b41ef78aa6c09e7bc5a489ba652bAffected
d08e973a77d128b25e01a08c34d89593fdf222da to before fb0c7c77a7ae3a2c3404b7d0173b8739a754b513Affected
d08e973a77d128b25e01a08c34d89593fdf222da to before 395d988f93861101ec89d0dd9e3b876ae9392a5bAffected

LinuxLinux

3.16Affected
before 3.16Not affected
6.1.191 through 6.1.*Not affected
6.6.119 through 6.6.*Not affected
6.12.61 through 6.12.*Not affected
6.17.11 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.