OpenWrt Patches ubusd RCE Flaw (CVE-2025-62526) and Kernel Memory Leak (CVE-2025-62525) in DSL Driver

OpenWrt has patched two high-severity vulnerabilities, CVE-2025-62526 and CVE-2025-62525, that could allow remote code execution or kernel memory access on affected devices, with fixes in OpenWrt version 24.10.4 and later. The first flaw, CVE-2025-62526, sits in ubusd, the central messaging daemon, and the advisory notes it “contains a heap buffer overflow in the event registration parsing code” that could let an attacker modify the head and potentially execute arbitrary code in the context of the ubus daemon.

According to the advisory, “the affected code is executed before running the ACL checks, all ubus clients are able to send such messages,” and the crafted subscription can also bypass the listen ACL. The second vulnerability, CVE-2025-62525, affects the ltq-ptm driver that controls the DSL datapath and could enable local users to read and write arbitrary kernel memory using the driver’s ioctls.

The issue impacts devices using xrx200, danube, and amazon SoCs in Packet Transfer Mode, and is addressed in 24.10.4 and snapshot builds released since mid-October 2025, with older versions such as 23.05 and 22.03 no longer supported. According to OpenWrt’s advisory, these fixes mitigate both the RCE risk and the kernel‑memory leak vulnerability.