CVE-2025-21743

Summary

In the Linux kernel, the following vulnerability has been resolved:

usbnet: ipheth: fix possible overflow in DPE length check

Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB read.

Move the wDatagramIndex term to the other side of the inequality.

An existing condition ensures that wDatagramIndex < urb->actual_length.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxa2d274c62e44b1995c170595db3865c6fe701226 < 18bf6f5cce3172cb303c3f0551aa9443d5ed74f8affected
LinuxLinuxa2d274c62e44b1995c170595db3865c6fe701226 < d677e7dd59ad6837496f5a02d8e5d39824278dfdaffected
LinuxLinuxa2d274c62e44b1995c170595db3865c6fe701226 < d824a964185910e317287f034c0a439c08b4fe49affected
LinuxLinuxa2d274c62e44b1995c170595db3865c6fe701226 < c219427ed296f94bb4b91d08626776dc7719ee27affected
LinuxLinux6.5affected
LinuxLinux0 < 6.5unaffected
LinuxLinux6.6.78 <= 6.6.*unaffected
LinuxLinux6.12.14 <= 6.12.*unaffected
LinuxLinux6.13.3 <= 6.13.*unaffected
LinuxLinux6.14 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References