CVE-2025-21877

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usbnet: gl620a: fix endpoint checking in genelink_bind()

Syzbot reports [1] a warning in usb_submit_urb() triggered by

inconsistencies between expected and actually present endpoints

in gl620a driver. Since genelink_bind() does not properly

verify whether specified eps are in fact provided by the device,

in this case, an artificially manufactured one, one may get a

mismatch.

Fix the issue by resorting to a usbnet utility function

usbnet_get_endpoints(), usually reserved for this very problem.

Check for endpoints and return early before proceeding further if

any are missing.

[1] Syzbot report:

usb 5-1: Manufacturer: syz

usb 5-1: SerialNumber: syz

usb 5-1: config 0 descriptor??

gl620a 5-1:0.23 usb0: register 'gl620a' at usb-dummy_hcd.0-1, ...

------------[ cut here ]------------

usb 5-1: BOGUS urb xfer, pipe 3 != type 1

WARNING: CPU: 2 PID: 1841 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References