CVE-2025-68217

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: pegasus-notetaker - fix potential out-of-bounds access

In the pegasus_notetaker driver, the pegasus_probe() function allocates

the URB transfer buffer using the wMaxPacketSize value from

the endpoint descriptor. An attacker can use a malicious USB descriptor

to force the allocation of a very small buffer.

Subsequently, if the device sends an interrupt packet with a specific

pattern (e.g., where the first byte is 0x80 or 0x42),

the pegasus_parse_packet() function parses the packet without checking

the allocated buffer size. This leads to an out-of-bounds memory access.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References