1. Home
  2. Vulnerabilities
  3. CVE-2025-68290
0.0
NA
CVE-2025-68290
most: usb: fix double free on late probe failure
Description

In the Linux kernel, the following vulnerability has been resolved: most: usb: fix double free on late probe failure The MOST subsystem has a non-standard registration function which frees the interface on registration failures and on deregistration. This unsurprisingly leads to bugs in the MOST drivers, and a couple of recent changes turned a reference underflow and use-after-free in the USB driver into several double free and a use-after-free on late probe failures.

INFO

Published Date :

Dec. 16, 2025, 4:16 p.m.

Last Modified :

Dec. 16, 2025, 4:16 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2025-68290 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Solution
Address double-free and use-after-free issues in the MOST subsystem by applying kernel updates.
  • Update the Linux kernel to the latest version.
  • Apply the patch resolving the MOST subsystem double-free.
  • Recompile and deploy the updated kernel.
  • Verify the fix by testing USB functionality.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-68290.

URL Resource
https://git.kernel.org/stable/c/0dece48660be16918ecf2dbdc7193e8be03e1693
https://git.kernel.org/stable/c/2274767dc02b756b25e3db1e31c0ed47c2a78442
https://git.kernel.org/stable/c/8d8ffefe3d5d8b7b73efb866db61130107299c5c
https://git.kernel.org/stable/c/90e6ce2b1b19fb8b9d4afee69f40e4c6a4791154
https://git.kernel.org/stable/c/993bfdc3842893c394de13c8200c338ebb979589
https://git.kernel.org/stable/c/a4c4118c2af284835b16431bbfe77e0130c06fef
https://git.kernel.org/stable/c/baadf2a5c26e802a46573eaad331b427b49aaa36
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-68290 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-68290 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-68290 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-68290 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Dec. 16, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: most: usb: fix double free on late probe failure The MOST subsystem has a non-standard registration function which frees the interface on registration failures and on deregistration. This unsurprisingly leads to bugs in the MOST drivers, and a couple of recent changes turned a reference underflow and use-after-free in the USB driver into several double free and a use-after-free on late probe failures.
    Added Reference https://git.kernel.org/stable/c/0dece48660be16918ecf2dbdc7193e8be03e1693
    Added Reference https://git.kernel.org/stable/c/2274767dc02b756b25e3db1e31c0ed47c2a78442
    Added Reference https://git.kernel.org/stable/c/8d8ffefe3d5d8b7b73efb866db61130107299c5c
    Added Reference https://git.kernel.org/stable/c/90e6ce2b1b19fb8b9d4afee69f40e4c6a4791154
    Added Reference https://git.kernel.org/stable/c/993bfdc3842893c394de13c8200c338ebb979589
    Added Reference https://git.kernel.org/stable/c/a4c4118c2af284835b16431bbfe77e0130c06fef
    Added Reference https://git.kernel.org/stable/c/baadf2a5c26e802a46573eaad331b427b49aaa36
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.