LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21877: usbnet: gl620a: fix endpoint checking in genelink_bind()

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix endpoint checking in genelink_bind() Syzbot reports [1] a warning in usb_submit_urb() triggered by inconsistencies between expected and actually present endpoints in gl620a driver. Since genelink_bind() does not properly verify whether specified eps are in fact provided by the device, in this case, an artificially manufactured one, one may get a mismatch. Fix the issue by resorting to a usbnet utility function usbnet_get_endpoints(), usually reserved for this very problem. Check for endpoints and return early before proceeding further if any are missing. [1] Syzbot report: usb 5-1: Manufacturer: syz usb 5-1: SerialNumber: syz usb 5-1: config 0 descriptor?? gl620a 5-1:0.23 usb0: register 'gl620a' at usb-dummy_hcd.0-1, ... ------------[ cut here ]------------ usb 5-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 2 PID: 1841 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Modules linked in: CPU: 2 UID: 0 PID: 1841 Comm: kworker/2:2 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: mld mld_ifc_work RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usbnet_start_xmit+0x6be/0x2780 drivers/net/usb/usbnet.c:1467 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3606 sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3827 [inline] __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_resolve_output net/core/neighbour.c:1514 [inline] neigh_resolve_output+0x5bc/0x950 net/core/neighbour.c:1494 neigh_output include/net/neighbour.h:539 [inline] ip6_finish_output2+0xb1b/0x2070 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0x3f9/0x1360 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] mld_sendpack+0x9f0/0x11d0 net/ipv6/mcast.c:1819 mld_send_cr net/ipv6/mcast.c:2120 [inline] mld_ifc_work+0x740/0xca0 net/ipv6/mcast.c:2651 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-21877 is a Linux kernel issue in the GL620A USB networking driver. A malformed or artificial USB device can present endpoint information that the driver did not validate correctly, triggering a kernel warning during USB network traffic handling. Public sources do not provide a CVSS score or confirmed business impact.

Executive priority

Treat as targeted kernel hygiene, not an emergency from current evidence. Prioritize updates on Linux endpoints, appliances, labs, and servers where untrusted USB devices can be attached or emulated.

Technical view

The flaw is in genelink_bind() in the usbnet gl620a driver. The driver failed to verify that expected USB endpoints were actually present before use. The kernel fix switches endpoint discovery to usbnet_get_endpoints() and exits early when endpoints are missing.

Likely exposure

Exposure appears limited to Linux systems with the gl620a USB network driver path reachable, especially systems that accept untrusted or test-crafted USB devices. The source lists Linux kernel versions and commit ranges as affected but does not provide a complete distribution-by-distribution exposure matrix.

Exploitation context

The source describes a Syzbot-generated artificial USB device triggering a usb_submit_urb() warning. KEV is false, and the provided sources do not report active exploitation, public weaponization, privilege escalation, or remote exploitation.

Researcher notes

Evidence is strongest for malformed USB descriptor handling causing a kernel warning. The bundle lacks CVSS, CWE, exploitability analysis, and impact beyond the warning path. Avoid assuming memory corruption, code execution, or remote reachability without additional vendor evidence.

Mitigation direction

  • Update to a kernel containing the referenced stable fixes.
  • Apply relevant distribution kernel updates, including Debian LTS advisories where applicable.
  • Restrict untrusted USB device attachment on sensitive Linux systems.
  • Check vendor kernel guidance for product-specific fixed versions.

Validation and detection

  • Inventory Linux kernels and identify systems using or allowing the gl620a USB networking driver.
  • Compare running kernels against vendor advisories and referenced stable commits.
  • Review kernel logs for GL620A, usbnet, or usb_submit_urb warnings.
  • Confirm updated kernels include the endpoint validation fix in genelink_bind().
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21877 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux47ee3051c856cc2aa95d35d577a8cb37279d540f, 47ee3051c856cc2aa95d35d577a8cb37279d540f, 47ee3051c856cc2aa95d35d577a8cb37279d540f, 47ee3051c856cc2aa95d35d577a8cb37279d540f, 47ee3051c856cc2aa95d35d577a8cb37279d540f, 47ee3051c856cc2aa95d35d577a8cb37279d540f, 47ee3051c856cc2aa95d35d577a8cb37279d540f, 47ee3051c856cc2aa95d35d577a8cb37279d540funaffected
LinuxLinux2.6.14, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.130, 6.6.81, 6.12.18, 6.13.6, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.