CVE-2025-68734

What it actually does

Memory leak in hfcsusb_probe() leaves ctrl_urb allocation unfreed when setup_instance() returns an error, with error paths restructured to use goto labels for cleanup.

Why it matters to the business

Repeated probe failures on systems using the affected ISDN USB driver can gradually exhaust kernel memory, risking instability or denial of service in environments with the listed GitLab container images; low urgency given absent KEV status and flat EPSS trend.

How an attack unfolds

An attacker causes repeated entry into hfcsusb_probe() with setup_instance() failing (via crafted USB device or driver load conditions) to trigger the unfreed allocation path and accumulate leaked memory over time.

How to fix it

Upgrade every affected package to the exact fixed version listed: gitlab-cng-17.8, gitaly-config-17.8, gitlab-base-17.8, gitlab-certificates-17.8, gitlab-cfssl-self-sign-scripts-17.8, gitlab-container-registry-17.8, gitlab-container-registry-scripts-17.8, gitlab-elasticsearch-indexer-17.8, gitlab-elasticsearch-indexer-compat-17.8, gitlab-exporter-17.8, gitlab-exporter-scripts-17.8, gitlab-geo-logcursor-scripts-17.8 and gitlab-gitaly-scripts-17.8 all to *-17.8.4-r31 (Chainguard or Wolfi variants).

How to confirm the fix worked

Inspect installed package versions against the 17.8.4-r31 fixed releases for each listed image; confirm absence of the original unfreed allocation path via source or binary diff of the hfcsusb module.

Typical attack path

1. Locate systems exposing the vulnerable hfcsusb driver in the kernel
2. Insert or simulate a USB device that forces probe invocation
3. Induce setup_instance() failure conditions repeatedly
4. Observe cumulative memory consumption without corresponding frees

How to detect it

Review kernel logs for repeated hfcsusb_probe error entries paired with increasing slab or kmalloc usage; correlate with USB device insertion events on affected systems.

What your security team should do

• Prioritize upgrade of all 25 affected GitLab container images to the 17.8.4-r31 fixed releases within standard change windows
• Audit kernel module loading policies to restrict hfcsusb where ISDN hardware is not required
• Monitor memory metrics on hosts running these images for anomalous growth patterns