CVE-2025-68289

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68289
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68289.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-68289
Downstream
Related
Published
2025-12-16T15:06:10.450Z
Modified
2026-03-20T12:46:20.835740Z
Summary
usb: gadget: f_eem: Fix memory leak in eem_unwrap
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: feem: Fix memory leak in eemunwrap

The existing code did not handle the failure case of usbepqueue in the command path, potentially leading to memory leaks.

Improve error handling to free all allocated resources on usbepqueue failure. This patch continues to use goto logic for error handling, as the existing error handling is complex and not easily adaptable to auto-cleanup helpers.

kmemleak results: unreferenced object 0xffffff895a512300 (size 240): backtrace: slabpostallochook+0xbc/0x3a4 kmemcachealloc+0x1b4/0x358 skbclone+0x90/0xd8 eemunwrap+0x1cc/0x36c unreferenced object 0xffffff8a157f4000 (size 256): backtrace: slabpostallochook+0xbc/0x3a4 __kmemcachealloc_node+0x1b4/0x2dc kmalloctrace+0x48/0x140 dwc3gadgetepallocrequest+0x58/0x11c usbepallocrequest+0x40/0xe4 eemunwrap+0x204/0x36c unreferenced object 0xffffff8aadbaac00 (size 128): backtrace: slabpostallochook+0xbc/0x3a4 __kmemcachealloc_node+0x1b4/0x2dc __kmalloc+0x64/0x1a8 eemunwrap+0x218/0x36c unreferenced object 0xffffff89ccef3500 (size 64): backtrace: slabpostallochook+0xbc/0x3a4 _kmemcacheallocnode+0x1b4/0x2dc kmalloctrace+0x48/0x140 eemunwrap+0x238/0x36c

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68289.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3b545788505b2e2883aff13bdddeacaf88942a4f
Fixed
a9985a88b2fc29fbe1657fe8518908e261d6889c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4249d6fbc10fd997abdf8a1ea49c0389a0edf706
Fixed
5a1628283cd9dccf1e44acfb74e77504f4dc7472
Fixed
0ac07e476944a5e4c2b8b087dd167dec248c1bdf
Fixed
41434488ca714ab15cb2a4d0378418d1be8052d2
Fixed
e72c963177c708a167a7e17ed6c76320815157cf
Fixed
0dea2e0069a7e9aa034696f8065945b7be6dd6b7
Fixed
e4f5ce990818d37930cd9fb0be29eee0553c59d9
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d55a236f1bab102e353ea5abb7b7b6ff7e847294
Last affected
8e275d3d5915a8f7db3786e3f84534bb48245f4c
Last affected
3680a6ff9a9ccd3c664663da04bef2534397d591
Last affected
d654be97e1b679616e3337b871a9ec8f31a88841
Last affected
8bdef7f21cb6e53c0ce3e1cbcb05975aa0dd0fe9
Last affected
77d7f071883cf2921a7547f82e41f15f7f860e35
Last affected
a55093941e38113dd6f5f5d5d2705fec3018f332

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68289.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.247
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.197
Type
ECOSYSTEM
Events
Introduced
5.14.0
Fixed
6.1.159
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.6.119
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.12.61
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.17.11

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68289.json"