CVE-2025-68308

What it actually does

A logic error in kvaser_usb_leaf_wait_cmd and kvaser_usb_leaf_read_bulk_callback allows round_up(pos, wMaxPacketSize) to return the current value of pos when a zero-length alignment command sits exactly on a USB packet boundary, so the buffer index never advances and the parser loops forever.

Why it matters to the business

Systems using the affected Kvaser USB CAN adapter driver can become unresponsive or suffer high CPU usage when the device sends data that triggers the loop, interrupting operations that rely on those adapters.

How an attack unfolds

An attacker with the ability to present a malicious or specially-timed USB device (or to replay crafted bulk transfers) supplies zero-length commands positioned at packet boundaries; the driver’s alignment logic fails to advance, the parsing loop never exits, and the kernel thread handling the device is stuck.

How to fix it

Apply the upstream fix (commit 58343e0a4d43699f0e2f5b169384bbe4c0217add) or later stable kernel containing the change that replaces round_up(pos) with round_up(pos + 1). Rebuild and reboot with the corrected driver; no configuration changes are required.

How to confirm the fix worked

Confirm the running kernel contains commit 58343e0 or later; exercise the kvaser_usb leaf driver with a device that produces boundary-aligned zero-length commands and verify the parsing loop terminates; monitor for absence of soft-lockup or hung-task warnings referencing the affected functions.

Typical attack path

1. Attacker gains ability to attach or emulate a Kvaser Leaf USB device
2. Device emits or replays a zero-length command exactly aligned to wMaxPacketSize
3. kvaser_usb_leaf_read_bulk_callback or wait_cmd calls round_up on the current pos
4. round_up returns the same value because pos is already a multiple of the packet size
5. pos is not incremented, the while loop condition remains true, and the thread spins indefinitely

How to detect it

Search kernel logs and dmesg for repeated entries from kvaser_usb_leaf_wait_cmd or kvaser_usb_leaf_read_bulk_callback, soft lockup or hung task warnings, or sustained high CPU in usb-storage or kvaser threads; correlate with USB device attach events for Kvaser Leaf hardware.

What your security team should do

• Prioritize patching any kernel trees that include the kvaser_usb leaf driver
• Verify that production systems using Kvaser USB CAN hardware are running a fixed kernel before the next maintenance window
• Add the driver source files to automated patch-scanning and SBOM processes