Device Initialization Flaw in Linux Kernel Affects USB Functionality

CVE-2025-68249

What is CVE-2025-68249?

The vulnerability in the Linux kernel relates to improper handling during USB device initialization. Specifically, in the hdm_probe() function, there is a faulty early error path that can lead to a device core warning. If an error occurs before device initialization, the function may attempt to release resources associated with an uninitialized device structure. This could result in undefined behavior, including potential memory leaks and incorrect resource handling. The issue highlights the importance of ensuring that device structures are fully initialized before any operations are performed on them.

References