CVE-2025-21704: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-21704 Overview

CVE-2025-21704 is an out-of-bounds write vulnerability [CWE-787] in the Linux kernel's cdc-acm USB driver. The flaw resides in the acm_ctrl_irq() function, which processes USB CDC notifications from communication devices. When the first fragment of a control transfer is shorter than struct usb_cdc_notification, the driver reads length fields from memory outside the received buffer. This can cause the expected_size - acm->nb_index calculation to wrap, leading to kernel memory corruption. The issue affects Linux kernel versions ranging from 2.6.12 through 6.14-rc2.

Critical Impact
A malicious or malformed USB device can corrupt kernel memory through the cdc-acm driver, potentially leading to local privilege escalation or system compromise on Linux hosts where ModemManager auto-opens /dev/ttyACM* devices.

Affected Products

Linux Kernel versions 2.6.12 through 6.14-rc2
Debian LTS distributions (per Debian LTS announcements)
Siemens industrial products incorporating affected kernel versions (per Siemens advisory SSA-265688)

Discovery Timeline

2025-02-22 - CVE-2025-21704 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-21704

Vulnerability Analysis

The vulnerability exists in the USB Communications Device Class Abstract Control Model (CDC-ACM) driver, specifically in the reassembly logic for fragmented control transfer notifications. The acm_ctrl_irq() interrupt handler processes incoming USB notifications, which may arrive split across multiple URB fragments. The driver attempts to compute an expected total size by reading the length field from struct usb_cdc_notification in the first fragment. When that first fragment is shorter than the notification structure, the driver reads beyond the bounds of valid data. The condition becomes exploitable for memory corruption when expected_size decreases between fragments, causing an unsigned arithmetic underflow in expected_size - acm->nb_index. The resulting wrapped value drives a subsequent buffer copy and produces an out-of-bounds write into kernel memory.

Root Cause

The root cause is missing input validation on USB control transfer buffer sizes before structure field access. The driver assumed the first fragment would always be at least sizeof(struct usb_cdc_notification) bytes. It also failed to validate that successive fragments report consistent wLength values. These omissions allow a malicious USB device to manipulate length fields across fragments and trigger the integer wrap.

Attack Vector

Exploitation requires the attacker-controlled USB device to be enumerated and /dev/ttyACM* to be opened. While normally user action is required, ModemManager — present on most desktop Linux distributions — automatically opens matching /dev/ttyACM* devices based on vendor and product IDs. This effectively reduces the attack to physical access with a malicious or modified USB device. The vulnerability has existed since the inception of the driver, but memory corruption became possible after commit ea2583529cd1 introduced fragmented notification reassembly.

No public proof-of-concept code has been released for CVE-2025-21704. Refer to the upstream patches in the Linux Kernel Change Log for technical details on the fix.

Detection Methods for CVE-2025-21704

Indicators of Compromise

Kernel oops or panic messages referencing acm_ctrl_irq, cdc-acm, or usb_cdc_notification in dmesg and /var/log/kern.log
Unexpected USB CDC-ACM device enumeration events from unknown vendor/product IDs in udev logs
ModemManager logs showing automatic open of /dev/ttyACM* for unrecognized devices
New error log entries indicating discarded notifications shorter than expected

Detection Strategies

Monitor kernel ring buffer messages for crashes or warnings originating from the cdc-acm driver module
Audit USB device connection events using usbguard or auditd rules tracking udev activity for serial-class devices
Track kernel version against fixed stable branches to identify unpatched hosts in your fleet
Correlate physical access events with USB enumeration of 0x02 (CDC) class devices on sensitive endpoints

Monitoring Recommendations

Enable kernel address sanitizer (KASAN) builds in test environments to surface out-of-bounds writes against the cdc-acm driver
Ship kernel logs and udev events to a centralized log platform for cross-host correlation of USB-related anomalies
Implement USB device allowlisting on workstations and servers handling sensitive workloads
Alert on any kernel panic referencing USB driver stack traces, particularly on shared or kiosk systems

How to Mitigate CVE-2025-21704

Immediate Actions Required

Apply the upstream Linux kernel patches from kernel.org stable trees and reboot affected systems
Update to the patched kernel packages distributed by your Linux distribution, including the Debian LTS updates referenced in Debian LTS Announcement (March 2025) and Debian LTS Announcement (May 2025)
For Siemens industrial environments, review and apply guidance in the Siemens Security Advisory SSA-265688
Restrict physical USB access on sensitive systems and disable ModemManager where it is not required

Patch Information

The fix adds a length check on the first control transfer fragment before accessing struct usb_cdc_notification fields and discards notifications that cannot yield a valid expected_size. Patched commits are available across multiple stable branches, including 383d516a0ebc, 6abb510251e7, 7828e9363ac4, 871619c2b78f, 90dd2f1b7342, a4e1ae5c0533, e563b01208f4, and f64079bef6a8. Reference the Linux Kernel Change Log for the canonical patch.

Workarounds

Blacklist the cdc-acm kernel module on systems that do not require USB modem or serial-class device support
Stop and disable the ModemManager service to prevent automatic opening of /dev/ttyACM* devices
Deploy usbguard policies that allow only explicitly approved USB device IDs and reject CDC-class devices by default
Apply strict physical security controls on endpoints, particularly unattended kiosks and lab equipment

bash

# Blacklist cdc-acm module and disable ModemManager
echo 'blacklist cdc_acm' | sudo tee /etc/modprobe.d/blacklist-cdc-acm.conf
sudo systemctl stop ModemManager.service
sudo systemctl disable ModemManager.service
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep cdc_acm