Memory Leak Vulnerability in Linux Kernel USB Gadget Functionality

CVE-2025-68289

What is CVE-2025-68289?

A vulnerability exists in the Linux kernel related to the USB gadget functionality, specifically within the 'eem_unwrap' method. The original implementation lacked proper error handling for the 'usb_ep_queue' function, resulting in potential memory leaks during operation. The updated patch addresses this issue by ensuring that all allocated resources are appropriately freed in the event of a failure. The use of goto logic for error handling remains, owing to the complexity of the existing code, ensuring robust management of memory resources.

References