CVE-2025-68308
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The and functions contain log…
Published Dec 16, 2025 · updated Oct 14, 2026
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The and functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip these placeholders by aligning the buffer position to the next packet boundary using function. However, if zero-length command is found exactly on a packet boundary (i.e., is a multiple of wMaxPacketSize, including 0), function will return the unchanged value of . This prevents to be increased, causing an infinite loop in the parsing logic. This patch fixes this in the function by using instead. This ensures that even if is on a boundary, the calculation is based on , forcing to always return the next aligned boundary.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Dec 16, 2025 · NIST NVD
Detected
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The and functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip these placeholders by aligning the buffer position to the next packet boundary using functio
Oct 14, 2026 · NIST NVD
Updated
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The and functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip these placeholders by aligning the buffer position to the next packet boundary using functio
Sources
- CVE.orgVulnerability recordCVE-2025-68308
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-68308
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2025-68308
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The and functions contain logic to zero-length commands. These commands ar
nvd.nist.gov