CVE-2025-39760

HighCVSS 7.1/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: core: config: Prevent OOB read in SS endpoint companion parsing

usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size.

Fix this up by checking the size first before looking at any of the fields in the descriptor.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
LinuxLinux>= 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 5c3097ede7835d3caf6543eb70ff689af4550cd2; >= 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 058ad2b722812708fe90567875704ae36563e33b; >= 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < b10e0f868067c6f25bbfabdcf3e1e6432c24ca55; >= 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 5badd56c711e2c8371d1670f9bd486697575423c; >= 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 9512510cee7d1becdb0e9413fdd3ab783e4e30ee; >= 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 4fe6f472f0beef4281e6f03bc38a910a33be663f; >= 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 9843bcb187cb933861f7805022e6873905f669e4; >= 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < cf16f408364efd8a68f39011a3b073c83a03612d
LinuxLinux2.6.35
SiemensSIMATIC CN 4100< V5.0

References

Timeline

Published
Sep 11, 2025
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-397617.1In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling CurreCVE-2025-397625.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: add null check [WHY] Prevents null pointer dereferencCVE-2025-397635.5In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error notCVE-2025-397645.5In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Same pCVE-2025-397655.5In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: fix ida_free call while not allocated In the snd_utimer_cCVE-2025-397667.8In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit CVE-2025-397675.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: Optimize module load time by optimizing PLT/GOT counting WhCVE-2025-397685.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix complex rules rehash error flow Moving rules from mCVE-2025-397695.5In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix lockdep warning during rmmod The commit under the Fixes tCVE-2025-39774.3A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unCVE-2025-397705.5In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUCVE-2025-397715.5In the Linux kernel, the following vulnerability has been resolved: regulator: pca9450: Use devm_register_sys_off_handler With module test
CVE-2025-39760: High severity, CVSS 7.1 | Vulnix