{"id":"CVE-2025-21916","title":"usb: atm: cxacru: fix a flaw in existing endpoint checks","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: fix a flaw in existing endpoint checks\n\nSyzbot once again identified a flaw in usb endpoint checking, see [1].\nThis time the issue stems from a commit…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 23926d316d2836315cb113569f91393266eb5b47 < dcd592ab9dd8a2bfc36e75583b9006db2a77ec24","Linux >= 75ddbf776dd04a09fb9e5267ead5d0c989f84506 < 319529e0356bd904528c64647725a2272d297c83","Linux >= 1aac4be1aaa5177506219f01dce5e29194e5e95a < bf4409f84023b52b5e9b36c0a071a121eee42138","Linux >= 5584c776a1af7807ca815ee6265f2c1429fc5727 < 197e78076c5ecd895f109158c4ea2954b9919af6","Linux >= f536f09eb45e4de8d1b9accee9d992aa1846f1d4 < a0475a885d69849b1ade38add6d64338dfa83a8f","Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < cfc295f7cccf66cbd5123416bcf1bee2e1bd37de","Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < 903b80c21458bb1e34c3a78c5fdc553821e357f8","Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < c90aad369899a607cfbc002bebeafd51e31900cd","Linux 5159a81924311c1ec786ad9fdef784ead8676a6a","Linux ac9007520e392541a29daebaae8b9109007bc781","Linux >= 5.4.279 < 5.4.291","Linux >= 5.10.221 < 5.10.235","Linux >= 5.15.162 < 5.15.179","Linux >= 6.1.97 < 6.1.131","Linux >= 6.6.37 < 6.6.83","Linux >= 4.19.317 < 4.20","Linux >= 6.9.8 < 6.10","Linux 6.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:36:54.452884Z"},"published":"2025-04-01","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:41:47.907Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21916","references":[{"url":"https://git.kernel.org/stable/c/dcd592ab9dd8a2bfc36e75583b9006db2a77ec24"},{"url":"https://git.kernel.org/stable/c/319529e0356bd904528c64647725a2272d297c83"},{"url":"https://git.kernel.org/stable/c/bf4409f84023b52b5e9b36c0a071a121eee42138"},{"url":"https://git.kernel.org/stable/c/197e78076c5ecd895f109158c4ea2954b9919af6"},{"url":"https://git.kernel.org/stable/c/a0475a885d69849b1ade38add6d64338dfa83a8f"},{"url":"https://git.kernel.org/stable/c/cfc295f7cccf66cbd5123416bcf1bee2e1bd37de"},{"url":"https://git.kernel.org/stable/c/903b80c21458bb1e34c3a78c5fdc553821e357f8"},{"url":"https://git.kernel.org/stable/c/c90aad369899a607cfbc002bebeafd51e31900cd"}],"tags":["cve.org"],"epss":0.00233,"epssPercentile":0.14258,"ingestedAt":"2026-11-05T22:38:31.854Z","slug":"CVE-2025-21916","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: fix a flaw in existing endpoint checks\n\nSyzbot once again identified a flaw in usb endpoint checking, see [1].\nThis time the issue stems from a commit authored by me (2eabb655a968\n(\"usb: atm: cxacru: fix endpoint checking in cxacru_bind()\")).\n\nWhile using usb_find_common_endpoints() may usually be enough to\ndiscard devices with wrong endpoints, in this case one needs more\nthan just finding and identifying the sufficient number of endpoints\nof correct types - one needs to check the endpoint's address as well.\n\nSince cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind,\nswitch the endpoint verification approach to usb_check_XXX_endpoints()\ninstead to fix incomplete ep testing.\n\n[1] Syzbot report:\nusb 5-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\n...\nRIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\n...\nCall Trace:\n <TASK>\n cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649\n cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline]\n cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223\n usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058\n cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377\n usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396\n really_probe+0x2b9/0xad0 drivers/base/dd.c:658\n __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800\n driver_probe_device+0x50/0x430 drivers/base/dd.c:830\n...\n\n## Affected\n\n- `Linux >= 23926d316d2836315cb113569f91393266eb5b47 < dcd592ab9dd8a2bfc36e75583b9006db2a77ec24`\n- `Linux >= 75ddbf776dd04a09fb9e5267ead5d0c989f84506 < 319529e0356bd904528c64647725a2272d297c83`\n- `Linux >= 1aac4be1aaa5177506219f01dce5e29194e5e95a < bf4409f84023b52b5e9b36c0a071a121eee42138`\n- `Linux >= 5584c776a1af7807ca815ee6265f2c1429fc5727 < 197e78076c5ecd895f109158c4ea2954b9919af6`\n- `Linux >= f536f09eb45e4de8d1b9accee9d992aa1846f1d4 < a0475a885d69849b1ade38add6d64338dfa83a8f`\n- `Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < cfc295f7cccf66cbd5123416bcf1bee2e1bd37de`\n- `Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < 903b80c21458bb1e34c3a78c5fdc553821e357f8`\n- `Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < c90aad369899a607cfbc002bebeafd51e31900cd`\n- `Linux 5159a81924311c1ec786ad9fdef784ead8676a6a`\n- `Linux ac9007520e392541a29daebaae8b9109007bc781`\n- `Linux >= 5.4.279 < 5.4.291`\n- `Linux >= 5.10.221 < 5.10.235`\n- `Linux >= 5.15.162 < 5.15.179`\n- `Linux >= 6.1.97 < 6.1.131`\n- `Linux >= 6.6.37 < 6.6.83`\n- `Linux >= 4.19.317 < 4.20`\n- `Linux >= 6.9.8 < 6.10`\n- `Linux 6.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}