CVE-2025-21916

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: cxacru: fix a flaw in existing endpoint checks

Syzbot once again identified a flaw in usb endpoint checking, see [1].

This time the issue stems from a commit authored by me (2eabb655a968

("usb: atm: cxacru: fix endpoint checking in cxacru_bind()")).

While using usb_find_common_endpoints() may usually be enough to

discard devices with wrong endpoints, in this case one needs more

than just finding and identifying the sufficient number of endpoints

of correct types - one needs to check the endpoint's address as well.

Since cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind,

switch the endpoint verification approach to usb_check_XXX_endpoints()

instead to fix incomplete ep testing.

[1] Syzbot report:

usb 5-1: BOGUS urb xfer, pipe 3 != type 1

WARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503

...

RIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References