In the Linux kernel, the following vulnerability has been resolved:

usb: potential integer overflow in usbg_make_tpg()

The variable tpgt in usbg_make_tpg() is defined as unsigned long and is
assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an
integer overflow when tpgt is greater than USHRT_MAX (65535). I
haven't tried to trigger it myself, but it is possible to trigger it
by calling usbg_make_tpg() with a large value for tpgt.

I modified the type of tpgt to match tpgt->tport_tpgt and adjusted the
relevant code accordingly.

This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential
memory corruption").

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
c52661d60f636d17e26ad834457db333bd1df494 affected < 0861b9cb2ff519b7c5a3b1dd52a343e18c4efb24
c52661d60f636d17e26ad834457db333bd1df494 affected < 603a83e5fee38a950bfcfb2f36449311fa00a474
c52661d60f636d17e26ad834457db333bd1df494 affected < 6f77e344515b5258edb3988188311464209b1c7c
c52661d60f636d17e26ad834457db333bd1df494 affected < 6722e080b5b39ab7471386c73d0c1b39572f943c
c52661d60f636d17e26ad834457db333bd1df494 affected < a33f507f36d5881f602dab581ab0f8d22b49762c
c52661d60f636d17e26ad834457db333bd1df494 affected < 358d5ba08f1609c34a054aed88c431844d09705a
c52661d60f636d17e26ad834457db333bd1df494 affected < 620a5e1e84a3a7004270703a118d33eeb1c0f368
c52661d60f636d17e26ad834457db333bd1df494 affected < 153874010354d050f62f8ae25cbb960c17633dc5
Linux Linux affected
Version Status Constraints
3.5 affected —
0 unaffected < 3.5
5.4.296 unaffected ≤ 5.4.*
5.10.240 unaffected ≤ 5.10.*
5.15.187 unaffected ≤ 5.15.*
6.1.143 unaffected ≤ 6.1.*
6.6.96 unaffected ≤ 6.6.*
6.12.36 unaffected ≤ 6.12.*
6.15.5 unaffected ≤ 6.15.*
6.16 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8028-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-2 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8031-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-3 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-4 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-5 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8031-2 Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-6 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-8031-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8052-1 Linux kernel (Low Latency) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-7 Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-8 Linux kernel (IBM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8052-2 Linux kernel (Xilinx) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0861b9cb2ff519b7c5a3b1dd52a343e18c4efb24 cve-icon cve-icon
https://git.kernel.org/stable/c/153874010354d050f62f8ae25cbb960c17633dc5 cve-icon cve-icon
https://git.kernel.org/stable/c/358d5ba08f1609c34a054aed88c431844d09705a cve-icon cve-icon
https://git.kernel.org/stable/c/603a83e5fee38a950bfcfb2f36449311fa00a474 cve-icon cve-icon
https://git.kernel.org/stable/c/620a5e1e84a3a7004270703a118d33eeb1c0f368 cve-icon cve-icon
https://git.kernel.org/stable/c/6722e080b5b39ab7471386c73d0c1b39572f943c cve-icon cve-icon
https://git.kernel.org/stable/c/6f77e344515b5258edb3988188311464209b1c7c cve-icon cve-icon
https://git.kernel.org/stable/c/a33f507f36d5881f602dab581ab0f8d22b49762c cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025122406-CVE-2025-68750-7ff1@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-68750 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-68750 cve-icon
History

Thu, 25 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 24 Dec 2025 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: potential integer overflow in usbg_make_tpg() The variable tpgt in usbg_make_tpg() is defined as unsigned long and is assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an integer overflow when tpgt is greater than USHRT_MAX (65535). I haven't tried to trigger it myself, but it is possible to trigger it by calling usbg_make_tpg() with a large value for tpgt. I modified the type of tpgt to match tpgt->tport_tpgt and adjusted the relevant code accordingly. This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential memory corruption").
Title usb: potential integer overflow in usbg_make_tpg()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-01-02T15:35:14.366Z

Reserved: 2025-12-24T10:30:51.032Z

Link: CVE-2025-68750

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-24T16:15:48.687

Modified: 2025-12-29T15:58:13.147

Link: CVE-2025-68750

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-12-24T00:00:00Z

Links: CVE-2025-68750 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.