CVE-2025-68217

What it actually does

Out-of-bounds memory access in the pegasus-notetaker USB driver when pegasus_probe allocates a transfer buffer sized from a maliciously small wMaxPacketSize descriptor and pegasus_parse_packet then processes an interrupt packet (first byte 0x80 or 0x42) without verifying buffer length.

Why it matters to the business

Kernel memory corruption on Linux systems exposing the driver can cause system crashes, denial of service, or potential privilege escalation when a crafted USB device is attached; low EPSS and no KEV listing reduce immediate ransomware risk but still require prompt patching of affected kernels and downstream packages.

How an attack unfolds

An attacker presents a malicious USB device whose endpoint descriptor reports an unusually small wMaxPacketSize; once the kernel allocates the undersized URB buffer, the device transmits an interrupt packet matching the trigger pattern, causing pegasus_parse_packet to read or write past the buffer bounds.

How to fix it

Upgrade to a kernel containing commit c4e746651bd74c38f581e1cf31651119a94de8cd or Chainguard packages argo-events-fips and argo-events-fips-compat version 1.9.5-r2; disable the pegasus-notetaker driver module if the hardware is not required.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or verify package versions match the stated fixed releases; test with a USB device emulator that supplies a minimal wMaxPacketSize and observe absence of OOB accesses.

Typical attack path

1. Attach malicious USB device reporting small wMaxPacketSize
2. Kernel allocates undersized transfer buffer in pegasus_probe
3. Device sends interrupt packet beginning with 0x80 or 0x42
4. pegasus_parse_packet accesses buffer without size validation
5. Out-of-bounds read/write triggers memory corruption

How to detect it

Review kernel logs and dmesg for pegasus_notetaker or pegasus_parse_packet entries around USB attach events; search for USB descriptor anomalies or sudden kernel oops/panics involving the driver; correlate with physical device insertion timestamps.

• pegasus_notetaker
• pegasus_parse_packet
• wMaxPacketSize
• first byte 0x80
• first byte 0x42

What your security team should do

• Apply the referenced kernel and package updates immediately on all affected systems
• Audit USB device allow-lists and consider blocking untrusted peripherals
• Blacklist the pegasus-notetaker module on systems that do not require it
• Monitor kernel logs for pegasus-related oops or memory corruption warnings