CVE-2025-68217: linux

CVSS: UnknownDeferred
AliasesUBUNTU-CVE-2025-68217DEBIAN-CVE-2025-68217
Published 16-12-2025Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2025-68217 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.6% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 42 · Related 39
DLA-4436-1MGASA-2026-0017MGASA-2026-0018OPENSUSE-SU-2026:20145-1SUSE-SU-2026:0278-1SUSE-SU-2026:0281-1

Timeline

  1. 16-12-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

0.00 pp

From 0.22% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu155 products
  • linuxAll versions (No fix recorded) | < 5.15.0-173.183 | < 6.8.0-106.106 | < 6.17.0-19.19
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110 | < 6.8.0-1050.53 | < 6.17.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.159-1 | < 6.12.63-1 | < 6.17.10-1
Linux1 product
  • linux≥ 1afca2b66aac7ac262d3511c68725e9e7053b40f, < c4e746651bd74c38f581e1cf31651119a94de8cd | ≥ 1afca2b66aac7ac262d3511c68725e9e7053b40f, < 36bc92b838ff72f62f2c17751a9013b29ead2513 | ≥ 1afca2b66aac7ac262d3511c68725e9e7053b40f, < 015b719962696b793997e8deefac019f816aca77 | ≥ 1afca2b66aac7ac262d3511c68725e9e7053b40f, < 084264e10e2ae8938a54355123ad977eb9df56d6 | ≥ 1afca2b66aac7ac262d3511c68725e9e7053b40f, < d344ea1baf1946c90f0cd6f9daeb5f3e0a0ca479 | ≥ 1afca2b66aac7ac262d3511c68725e9e7053b40f, < 9ab67eff6d654e34ba6da07c64761aa87c2a3c26 | ≥ 1afca2b66aac7ac262d3511c68725e9e7053b40f, < 763c3f4d2394a697d14af1335d3bb42f05c9409f | ≥ 1afca2b66aac7ac262d3511c68725e9e7053b40f, < 69aeb507312306f73495598a055293fa749d454e | 4.8

3 vendors · 157 products

References

38 links
Show all 38 references