---
id: CVE-2025-21916
title: 'usb: atm: cxacru: fix a flaw in existing endpoint checks'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: atm: cxacru: fix a flaw in existing endpoint checks

  Syzbot once again identified a flaw in usb endpoint checking, see [1].
  This time the issue stems from a commit…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 23926d316d2836315cb113569f91393266eb5b47 <
    dcd592ab9dd8a2bfc36e75583b9006db2a77ec24
  - >-
    Linux >= 75ddbf776dd04a09fb9e5267ead5d0c989f84506 <
    319529e0356bd904528c64647725a2272d297c83
  - >-
    Linux >= 1aac4be1aaa5177506219f01dce5e29194e5e95a <
    bf4409f84023b52b5e9b36c0a071a121eee42138
  - >-
    Linux >= 5584c776a1af7807ca815ee6265f2c1429fc5727 <
    197e78076c5ecd895f109158c4ea2954b9919af6
  - >-
    Linux >= f536f09eb45e4de8d1b9accee9d992aa1846f1d4 <
    a0475a885d69849b1ade38add6d64338dfa83a8f
  - >-
    Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 <
    cfc295f7cccf66cbd5123416bcf1bee2e1bd37de
  - >-
    Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 <
    903b80c21458bb1e34c3a78c5fdc553821e357f8
  - >-
    Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 <
    c90aad369899a607cfbc002bebeafd51e31900cd
  - Linux 5159a81924311c1ec786ad9fdef784ead8676a6a
  - Linux ac9007520e392541a29daebaae8b9109007bc781
  - Linux >= 5.4.279 < 5.4.291
  - Linux >= 5.10.221 < 5.10.235
  - Linux >= 5.15.162 < 5.15.179
  - Linux >= 6.1.97 < 6.1.131
  - Linux >= 6.6.37 < 6.6.83
  - Linux >= 4.19.317 < 4.20
  - Linux >= 6.9.8 < 6.10
  - Linux 6.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:36:54.452884Z'
published: '2025-04-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:41:47.907Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21916'
references:
  - url: 'https://git.kernel.org/stable/c/dcd592ab9dd8a2bfc36e75583b9006db2a77ec24'
  - url: 'https://git.kernel.org/stable/c/319529e0356bd904528c64647725a2272d297c83'
  - url: 'https://git.kernel.org/stable/c/bf4409f84023b52b5e9b36c0a071a121eee42138'
  - url: 'https://git.kernel.org/stable/c/197e78076c5ecd895f109158c4ea2954b9919af6'
  - url: 'https://git.kernel.org/stable/c/a0475a885d69849b1ade38add6d64338dfa83a8f'
  - url: 'https://git.kernel.org/stable/c/cfc295f7cccf66cbd5123416bcf1bee2e1bd37de'
  - url: 'https://git.kernel.org/stable/c/903b80c21458bb1e34c3a78c5fdc553821e357f8'
  - url: 'https://git.kernel.org/stable/c/c90aad369899a607cfbc002bebeafd51e31900cd'
tags:
  - cve.org
epss: 0.00233
epssPercentile: 0.14258
ingestedAt: '2026-11-05T22:38:31.854Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: cxacru: fix a flaw in existing endpoint checks

Syzbot once again identified a flaw in usb endpoint checking, see [1].
This time the issue stems from a commit authored by me (2eabb655a968
("usb: atm: cxacru: fix endpoint checking in cxacru_bind()")).

While using usb_find_common_endpoints() may usually be enough to
discard devices with wrong endpoints, in this case one needs more
than just finding and identifying the sufficient number of endpoints
of correct types - one needs to check the endpoint's address as well.

Since cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind,
switch the endpoint verification approach to usb_check_XXX_endpoints()
instead to fix incomplete ep testing.

[1] Syzbot report:
usb 5-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503
...
RIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503
...
Call Trace:
 <TASK>
 cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649
 cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline]
 cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223
 usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058
 cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377
 usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396
 really_probe+0x2b9/0xad0 drivers/base/dd.c:658
 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800
 driver_probe_device+0x50/0x430 drivers/base/dd.c:830
...

## Affected

- `Linux >= 23926d316d2836315cb113569f91393266eb5b47 < dcd592ab9dd8a2bfc36e75583b9006db2a77ec24`
- `Linux >= 75ddbf776dd04a09fb9e5267ead5d0c989f84506 < 319529e0356bd904528c64647725a2272d297c83`
- `Linux >= 1aac4be1aaa5177506219f01dce5e29194e5e95a < bf4409f84023b52b5e9b36c0a071a121eee42138`
- `Linux >= 5584c776a1af7807ca815ee6265f2c1429fc5727 < 197e78076c5ecd895f109158c4ea2954b9919af6`
- `Linux >= f536f09eb45e4de8d1b9accee9d992aa1846f1d4 < a0475a885d69849b1ade38add6d64338dfa83a8f`
- `Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < cfc295f7cccf66cbd5123416bcf1bee2e1bd37de`
- `Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < 903b80c21458bb1e34c3a78c5fdc553821e357f8`
- `Linux >= 2eabb655a968b862bc0c31629a09f0fbf3c80d51 < c90aad369899a607cfbc002bebeafd51e31900cd`
- `Linux 5159a81924311c1ec786ad9fdef784ead8676a6a`
- `Linux ac9007520e392541a29daebaae8b9109007bc781`
- `Linux >= 5.4.279 < 5.4.291`
- `Linux >= 5.10.221 < 5.10.235`
- `Linux >= 5.15.162 < 5.15.179`
- `Linux >= 6.1.97 < 6.1.131`
- `Linux >= 6.6.37 < 6.6.83`
- `Linux >= 4.19.317 < 4.20`
- `Linux >= 6.9.8 < 6.10`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.