Integer Overflow Vulnerability in Linux Kernel Affects USB Functionality

CVE-2025-68750

What is CVE-2025-68750?

A vulnerability in the Linux kernel related to the function usbg_make_tpg() poses a risk of integer overflow, which could be exploited by providing an excessively large value for the tpgt variable. The tpgt variable is defined as unsigned long while being assigned to tpgt->tport_tpgt, which is defined as u16. This mismatch creates a potential for overflow when tpgt exceeds the USHRT_MAX limit of 65535. A patch has been implemented that rectifies the type of tpgt to match tpgt->tport_tpgt, consequently enhancing the security and stability of USB functionalities within the Linux kernel.

References