CVE-2025-21704: usb: cdc-acm: Check control transfer buffer size before access

Vulnerability summary

CVE-2025-21704 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-02-2025
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing `expected_size - acm->nb_index` to wrap. This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications"). A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.