CVE-2025-21776

What it actually does

Improper validation of USB hub devices allows binding to non-compliant devices with multiple configurations or interfaces, resulting in usb_hub_to_struct_hub() dereferencing a NULL or invalid pointer and triggering a kernel general protection fault.

Why it matters to the business

A physically connected malicious USB device can crash the system, causing denial of service and potential loss of availability on affected Linux hosts; with only one downstream dependent the operational blast radius remains limited but requires urgent patching on exposed systems.

How an attack unfolds

An attacker creates or uses a non-compliant USB device that advertises more than one configuration or interface; when the device is attached the hub driver incorrectly binds to the wrong interface, causing the kernel crash during hub event processing. Related kernel privilege-escalation CVEs have been exploited by named threat actors, indicating possible interest in chaining this flaw for further impact.

How to fix it

Upgrade affected salt packages to version 2016.11.7 or later; apply the corresponding Linux kernel patch that rejects non-compliant hub devices with more than one configuration or interface.

How to confirm the fix worked

Confirm the kernel no longer accepts multi-config or multi-interface hub devices by testing with a non-compliant USB device; verify the fixed salt version is installed and check for absence of the crash in hub_probe paths.

Typical attack path

1. Prepare non-compliant USB device with multiple configurations or interfaces
2. Attach device to target system
3. Kernel USB subsystem processes the device and binds hub driver to incorrect interface
4. usb_hub_to_struct_hub dereferences invalid pointer during hub_event workqueue execution
5. System oops and crashes

How to detect it

Review kernel logs for general protection faults in usb_hub_adjust_deviceremovable or hub_probe; look for USB device attachment events immediately preceding crashes; correlate with workqueue activity on usb_hub_wq.

What your security team should do

• Immediately upgrade all salt installations to 2016.11.7
• Block untrusted USB devices via policy or hardware controls until patched
• Monitor for kernel oops logs related to usb_hub_adjust_deviceremovable
• Prioritize patching on systems with direct USB access