In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory. Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/04a8a6393f3f2f471e05eacca33282dd30b01432 cve-icon cve-icon
https://git.kernel.org/stable/c/26e9b5da3231da7dc357b363883b5b7b51a64092 cve-icon cve-icon
https://git.kernel.org/stable/c/5ebe8d479aaf4f41ac35e6955332304193c646f6 cve-icon cve-icon
https://git.kernel.org/stable/c/a20f1dd19d21dcb70140ea5a71b1f8cbe0c7e68f cve-icon cve-icon
https://git.kernel.org/stable/c/aa64e0e17e3a5991a25e6a46007770c629039869 cve-icon cve-icon
https://git.kernel.org/stable/c/b59d4fda7e7d0aff1043a7f742487cb829f5aac1 cve-icon cve-icon
https://git.kernel.org/stable/c/d00a6c04a502cd52425dbf35588732c652b16490 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025121248-CVE-2025-40345-1796@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-40345 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-40345 cve-icon
History

Sat, 13 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Fri, 12 Dec 2025 18:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory. Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries.
Title usb: storage: sddr55: Reject out-of-bound new_pba
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-12-12T17:53:06.853Z

Updated: 2025-12-12T17:53:06.853Z

Reserved: 2025-04-16T07:20:57.187Z

Link: CVE-2025-40345

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2025-12-12T18:15:39.253

Modified: 2025-12-12T18:15:39.253

Link: CVE-2025-40345

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-12T00:00:00Z

Links: CVE-2025-40345 - Bugzilla