Infinite Loop Vulnerability in Linux Kernel Kvaser USB Driver

CVE-2025-68308

What is CVE-2025-68308?

A logic error in the Kvaser USB driver within the Linux kernel can lead to an infinite loop during command parsing. The functions responsible for managing zero-length commands inadvertently fail when aligning data to the boundary of USB endpoint's maximum packet size. Specifically, if a zero-length command is located precisely at a packet boundary, the buffer position does not advance correctly, causing the driver to enter an infinite loop. This issue has been addressed through a patch that modifies the calculation to ensure that the buffer position is always updated, preventing potential parsing failures.

References