Junglewise Threat Intelligence

CVE-2025-40345: Linux Kernel heap corruption in SDDR-55 USB storage driver

CVE-2025-40345 · Severity: info · CVSS 6.8 · Published 2025-12-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB storage driver for SDDR-55 devices could allow a malicious USB device to corrupt system memory. By providing a specially crafted response during a data write operation, a 'bogus' device can cause the operating system to crash or potentially execute unauthorized code. This requires physical access to plug the malicious device into the target system.

Technical details

A heap-based out-of-bounds write vulnerability exists in the sddr55_write_data function within drivers/usb/storage/sddr55.c. The driver fails to validate the 'new_pba' (Physical Block Address) value returned in the status packet from the USB device after a write operation. An attacker with physical access can use a malicious USB device to return a PBA value exceeding the allocated 'pba_to_lba' array size, leading to heap corruption. This can result in a kernel panic or potential local privilege escalation. The fix introduces a bounds check against the computed block count derived from the device's reported capacity.

Affected products

  • Linux Linux Kernel All versions prior to fixed releases in 6.12, 6.11, 6.6, 6.1, 5.15, 5.10, 5.4, and 4.19 branches

Timeline

  • 2025-11-16: other: Vulnerability discovered and patch submitted by Tianchu Chen
  • 2025-12-12: advisory: NVD published CVE-2025-40345
  • 2025-12-07: patched: Patch merged into various stable kernel branches

References

Related threats