CVE-2025-21708: net: usb: rtl8150: enable basic endpoint checking

Q: What conditions are required to trigger the issue?

An attacker or local process needs local access with low privileges. The affected RTL8150 USB network-driver path must be exercised so that a URB is submitted using an endpoint with the wrong USB endpoint type; no user interaction is required.

Q: What is the practical impact?

The reported impact is denial of service, with a CVSS availability impact of high. The failure produces a USB core warning during URB submission; the provided data does not indicate confidentiality or integrity impact.

Q: Which systems are most relevant to triage?

Systems running the Linux kernel and using the rtl8150 USB network driver are the relevant population. The supplied data does not identify specific affected kernel versions or state whether the driver is enabled or loaded by default.

Q: How can I identify signs that this issue has been triggered?

Kernel logs may contain a USB warning such as "BOGUS urb xfer" and a message indicating that the pipe type does not match the endpoint type, emitted from usb_submit_urb in drivers/usb/core/urb.c.

Q: What mitigation is indicated if an update cannot be applied immediately?

The provided remediation is to enable basic checking of bulk and interrupt endpoints in the RTL8150 driver. No separate operational workaround is provided in the supplied data.

Published Feb 27, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: usb: rtl8150: enable basic endpoint checking

Syzkaller reports [1] encountering a common issue of utilizing a wrong usb endpoint type during URB submitting stage. This, in turn, triggers a warning shown below.

For now, enable simple endpoint checking (specifically, bulk and interrupt eps, testing control one is not essential) to mitigate the issue with a view to do other related cosmetic changes later, if they are necessary.

[1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usbsubmiturb+0xe4b/0x1730 driv> Modules linked in: CPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:usbsubmiturb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Code: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8> RSP: 0018:ffffc9000441f740 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888112487a00 RCX: ffffffff811a99a9 RDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c FS: 00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> rtl8150open+0x300/0xe30 drivers/net/usb/rtl8150.c:733 devopen+0x2d4/0x4e0 net/core/dev.c:1474 devchangeflags+0x561/0x720 net/core/dev.c:8838 devchangeflags+0x8f/0x160 net/core/dev.c:8910 devinetioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177 inetioctl+0x3aa/0x3f0 net/ipv4/afinet.c:1003 sockdoioctl+0x116/0x280 net/socket.c:1222 sockioctl+0x22e/0x6c0 net/socket.c:1341 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:907 [inline] sesysioctl fs/ioctl.c:893 [inline] x64sysioctl+0x193/0x220 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcd/0x250 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7fc04ef73d49 ...

This change has not been tested on real hardware.

Affected Software

13 affected components

Linux Linux kernel

Linux Linux kernel>=2.6.13<5.4.291

Linux Linux kernel>=5.5<5.10.235

Linux Linux kernel>=5.11<5.15.179

Linux Linux kernel>=5.16<6.1.129

Linux Linux kernel>=6.2<6.6.76

Linux Linux kernel>=6.7<6.12.13

Linux Linux kernel>=6.13<6.13.2

Linux Linux kernel=2.6.12

Linux Linux kernel=2.6.12-rc2

Linux Linux kernel=2.6.12-rc3

Linux Linux kernel=2.6.12-rc4

Linux Linux kernel=2.6.12-rc5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Enable basic endpoint checking when submitting URBs, specifically for bulk and interrupt endpoints; checking the control endpoint is not essential.
Linux kernel rtl8150 USB network driver basic endpoint checking = enabled for bulk and interrupt endpoints

Event History

Feb 27, 2025

CVE Published

via MITRE·02:07 AM

Data Sourced

via MITRE·02:07 AM

Description

Data Sourced

via NVD·02:15 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to trigger the issue?

An attacker or local process needs local access with low privileges. The affected RTL8150 USB network-driver path must be exercised so that a URB is submitted using an endpoint with the wrong USB endpoint type; no user interaction is required.

What is the practical impact?

The reported impact is denial of service, with a CVSS availability impact of high. The failure produces a USB core warning during URB submission; the provided data does not indicate confidentiality or integrity impact.

Which systems are most relevant to triage?

Systems running the Linux kernel and using the rtl8150 USB network driver are the relevant population. The supplied data does not identify specific affected kernel versions or state whether the driver is enabled or loaded by default.

How can I identify signs that this issue has been triggered?

Kernel logs may contain a USB warning such as "BOGUS urb xfer" and a message indicating that the pipe type does not match the endpoint type, emitted from usb_submit_urb in drivers/usb/core/urb.c.

What mitigation is indicated if an update cannot be applied immediately?

The provided remediation is to enable basic checking of bulk and interrupt endpoints in the RTL8150 driver. No separate operational workaround is provided in the supplied data.

CVE-2025-21708: net: usb: rtl8150: enable basic endpoint checking

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the issue?

What is the practical impact?

Which systems are most relevant to triage?

How can I identify signs that this issue has been triggered?

What mitigation is indicated if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the issue?

What is the practical impact?

Which systems are most relevant to triage?

How can I identify signs that this issue has been triggered?

What mitigation is indicated if an update cannot be applied immediately?