CVE-2025-40345 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory. Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries.
A vulnerability in the Linux kernel's USB storage driver for SDR55 devices allows for out-of-bounds writes that can corrupt heap memory. This issue arises because a malicious device can report block addresses exceeding the actual capacity, causing the driver to access invalid memory regions. The vulnerability has been addressed by implementing checks to reject these out-of-bounds block addresses before they can be processed.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-253495.html | siemens-SADP | |
| https://git.kernel.org/stable/c/04a8a6393f3f2f471e05eacca33282dd30b01432 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/26e9b5da3231da7dc357b363883b5b7b51a64092 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/5ebe8d479aaf4f41ac35e6955332304193c646f6 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/a20f1dd19d21dcb70140ea5a71b1f8cbe0c7e68f | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/aa64e0e17e3a5991a25e6a46007770c629039869 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/b59d4fda7e7d0aff1043a7f742487cb829f5aac1 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/d00a6c04a502cd52425dbf35588732c652b16490 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
| Linux USB Storage Device | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| Jun 2, 2026 | CVE Modified | siemens-SADP |
| Dec 12, 2025 | New CVE Received | kernel.org |