CVE-2025-22003

What it actually does

One-byte out-of-bounds read on the source buffer passed to strscpy() inside the ucan USB CAN driver when the firmware string returned by usb_control_msg() is not NUL-terminated.

Why it matters to the business

May allow local information disclosure or kernel instability on systems using affected USB CAN adapters; low exploitability reduces immediate operational risk but still requires patching of production Linux kernels.

How an attack unfolds

An attacker with local access triggers the firmware string retrieval path in the ucan driver; the non-terminated buffer causes strscpy() to read one byte past the end of the source, potentially disclosing adjacent kernel memory.

How to fix it

Upgrade the Linux kernel to a version containing commit cc29775a8a72d7f3b56cc026796ad99bd65804a7 or later; remove reliance on the local firmware_str buffer and ensure NUL termination immediately after usb_control_msg() returns.

How to confirm the fix worked

Confirm the kernel source contains the referenced commit or that the ucan_ctl_payload structure uses a char fw_str field with direct termination logic; run kernel self-tests or module load tests with a non-terminated firmware response.

Typical attack path

1. Obtain local access on a Linux system with a ucan USB device
2. Trigger ucan_device_request_in / firmware string fetch via ioctl or driver initialization
3. Read the single out-of-bounds byte leaked into the destination buffer or via side effects
4. Use disclosed byte to aid further kernel exploitation or cause denial of service

How to detect it

Review kernel logs for oops or KASAN reports mentioning strscpy or ucan; inspect USB control transfers involving firmware strings; no widespread in-the-wild indicators exist for this specific flaw.

What your security team should do

• Prioritize kernel updates on systems exposing CAN/USB hardware
• Monitor EPSS and KEV status for any increase in observed exploitation
• Restrict local user access to CAN device nodes until patches are applied