CVE-2025-21704

Q: What is the severity of CVE-2025-21704?

CVE-2025-21704 has a CVSS score of 7.8 (HIGH). A memory corruption vulnerability in the Linux kernel's USB CDC-ACM driver allows attackers to corrupt kernel memory when processing fragmented USB control notifications. This affects Linux systems with USB CDC-ACM devices (like modems) connected, particularly when ModemManager automatically opens these devices. The vulnerability has existed since the beginning of git history but only became exploitable after a 2023 commit.

7.8 HIGH

📋 TL;DR

A memory corruption vulnerability in the Linux kernel's USB CDC-ACM driver allows attackers to corrupt kernel memory when processing fragmented USB control notifications. This affects Linux systems with USB CDC-ACM devices (like modems) connected, particularly when ModemManager automatically opens these devices. The vulnerability has existed since the beginning of git history but only became exploitable after a 2023 commit.

💻 Affected Systems

Products:

Linux kernel

Versions: All versions up to fix commits (present since beginning of git history, exploitable since commit ea2583529cd1 in 2023)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires USB CDC-ACM driver loaded and USB device connection. ModemManager automatically opens /dev/ttyACM* for many modem devices based on vendor/product IDs.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory corruption leading to system crash, privilege escalation, or arbitrary code execution in kernel context.

🟠

Likely Case

System instability, kernel panics, or denial of service when processing malformed USB notifications from malicious or faulty devices.

🟢

If Mitigated

No impact if the vulnerable driver isn't loaded or no USB CDC-ACM devices are connected.

🌐 Internet-Facing: LOW - Requires physical or local USB device access, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Requires USB device connection, but malicious USB devices or compromised peripherals could trigger exploitation.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires USB device access and ability to send malformed control notifications. Timing constraints exist due to fragment processing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 383d516a0ebc, 6abb510251e7, 7828e9363ac4, 871619c2b78f, or 90dd2f1b7342

Vendor Advisory: https://git.kernel.org/stable/c/383d516a0ebc8641372b521c8cb717f0f1834831

Restart Required: No

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels, apply the CDC-ACM buffer size check patch. 3. No reboot required if using kernel livepatch capabilities.

🔧 Temporary Workarounds

Disable USB CDC-ACM driver

all

Prevent loading of vulnerable driver module

echo 'blacklist cdc_acm' >> /etc/modprobe.d/blacklist-cdc-acm.conf
rmmod cdc_acm

Disable ModemManager auto-opening

all

Prevent automatic device opening that enables the vulnerability

systemctl stop ModemManager
systemctl disable ModemManager

🧯 If You Can't Patch

Restrict physical USB device access to trusted devices only
Implement USB device whitelisting/blacklisting policies

🔍 How to Verify

Check if Vulnerable:

Check if cdc_acm module is loaded: lsmod | grep cdc_acm. Check kernel version against patched releases.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits: uname -r. Check with distribution vendor for specific patched versions.

📡 Detection & Monitoring

Log Indicators:

Kernel oops/panic messages
USB error messages in dmesg
ModemManager crash logs

Network Indicators:

Unusual USB device connection patterns

SIEM Query:

source="kernel" AND ("cdc_acm" OR "CDC-ACM") AND ("error" OR "panic" OR "oops")

📊 Metadata

CVE ID: CVE-2025-21704

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

EPSS Score: 0.04% exploit probability (10.3th percentile)

Published: February 22, 2025

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable USB CDC-ACM driver

Disable ModemManager auto-opening

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities