CVE-2025-21704
HighSummary
A vulnerability has been identified in the Linux kernel within the usb: cdc-acm module, which lacks a check on the control transfer buffer size before access. If the first fragment is shorter than the usb_cdc_notification structure, it may lead to memory corruption.
Risk Assessment
This vulnerability can lead to memory corruption, posing a risk of system instability and potential data leakage. This is particularly dangerous in environments where ModemManager automatically opens USB devices.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability. Additionally, monitoring and controlling the operation of ModemManager concerning connected USB devices is advisable.
Related vulnerabilities
- CVE-2026-94053Critical
Authentication bypass via LDAP injection in the sshd-ldap component of Apache MINA SSHD. Lack of escaping LDAP filter metacharacters enables successful authentication with username "*" and password "*".
- CVE-2026-94052Critical
A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD allows bypassing authentication checks. The vulnerability only affects servers using LdapPasswordAuthenticator for password authentication.
- CVE-2026-77185Critical
Authentication bypass in sshd-core of Apache MINA SSHD. A flaw in the implementation of the "asynchronous authentication" mechanism could potentially lead to skipping signature checks in public-key or hostbased authentication, or returning a wrong result.
- CVE-2026-102458Critical
Missing Authentication vulnerability in EasyFlow .NET by Digiwin. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
- CVE-2026-102455Critical
Insecure Deserialization vulnerability in EasyFlow .NET by Digiwin. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- CVE-2026-102508Critical
The OPC UA driver in Apache PLC4X (PLC4J) improperly verifies cryptographic signatures and server certificates. An attacker in a network position between client and server can impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials sent by the client. The issue affects versions 0.9.0 through 0.13.1 and is fixed in version 1.0.0.
- CVE-2026-97196Critical
Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.
- CVE-2026-103110Critical
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.
- CVE-2026-102911Critical
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to OS command injection. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2026-103056Critical
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing `expected_size - acm->nb_index` to wrap. This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications"). A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS