Junglewise Threat Intelligence

CVE-2025-39760: Linux Kernel out-of-bounds read in USB SS endpoint companion parsing

CVE-2025-39760 · Severity: high · CVSS 7.1 · Published 2025-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB driver could allow a local user to trigger an out-of-bounds memory read. This occurs when the system processes specific USB device descriptors, potentially leading to a system crash or the exposure of sensitive kernel memory. The issue affects a wide range of Linux distributions and kernel versions.

Technical details

An out-of-bounds (OOB) read vulnerability exists in the `usb_parse_ss_endpoint_companion()` function within `drivers/usb/core/config.c`. The root cause is that the function validates the descriptor type field before verifying that the buffer is large enough to contain the descriptor. By providing a malformed USB descriptor where the reported size is smaller than the expected `USB_DT_SS_EP_COMP_SIZE`, an attacker can trigger a read outside the intended buffer boundaries. This is a local attack vector requiring the ability to interface with USB configuration parsing. Patches have been released across multiple stable kernel branches to ensure the size check occurs before field access.

Affected products

  • Linux Linux Kernel 2.6.35 to 5.10.241, 5.11 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.43, 6.13 to 6.15.11, 6.16 to 6.16.2

Timeline

  • 2025-09-11: disclosed
  • 2025-08-28: patched: Patched in various stable branches by Greg Kroah-Hartman
  • 2025-09-11: advisory

References

Related threats