CVE-2025-21704

What it actually does

Insufficient buffer size validation in the CDC-ACM USB driver allows out-of-bounds memory access when reassembling fragmented control notifications, leading to integer wrap-around and memory corruption on subsequent fragments.

Why it matters to the business

Attackers with local access or the ability to trigger USB device interactions can achieve privilege escalation and full system compromise on affected Linux kernels; prevalence in servers, containers, and desktops using USB modems increases exposure, with automatic opening by ModemManager removing a key mitigation.

How an attack unfolds

An attacker supplies a malicious or malformed USB CDC notification split across fragments where the initial fragment is shorter than expected; the driver skips the size check, miscalculates expected_size, and performs unsafe memory operations when the size decreases, resulting in corruption after userspace opens the ttyACM device.

How to fix it

Update the Linux kernel to commit a4e1ae5c0533964170197e4fb4f33bc8c1db5cd2 or later stable releases that include the buffer size check; for Bitnami mariadb deployments, upgrade to version 10.1.48 or newer containing the fixed kernel.

How to confirm the fix worked

Confirm the running kernel contains commit a4e1ae5c0533964170197e4fb4f33bc8c1db5cd2; test by attaching a CDC-ACM device and verifying no error logs or crashes occur on notification receipt; review dmesg for the new size-check error message.

Typical attack path

1. Attach or emulate a USB CDC-ACM device that sends fragmented notifications
2. Ensure /dev/ttyACM* is opened (via ModemManager or direct access)
3. Deliver short first fragment followed by subsequent fragments that trigger size wrap-around
4. Leverage resulting memory corruption for privilege escalation or code execution

How to detect it

Search kernel logs for cdc-acm error messages about short fragments or notification handling; inspect dmesg and syslog around USB attach events; correlate with processes opening /dev/ttyACM* such as ModemManager.

What your security team should do

• Apply the kernel fix immediately on all systems exposing ttyACM devices
• Disable or restrict ModemManager where USB CDC-ACM devices are not required
• Monitor for new kernel releases and schedule staged rollouts given the 613-day publication window
• Audit environments for USB device attachment policies to reduce local attack surface