CVE-2025-39760

Advisory lineage Upstream: 0 Downstream: 62
Modified
Published: 11 Sept 2025, 16:52
Last modified:12 May 2026, 12:06

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7.1 HIGH
v3.1 (nvd)
EPSS Score
0.03% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Sept 2025, 16:52
Published
Vulnerability first disclosed
12 May 2026, 12:06
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.

CVSS Metrics

  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS Trends

Current EPSS score: 0.03%• Percentile: 8%

Techniques & Countermeasures

  • CWE-125•Out-of-bounds Read

    The product reads data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • debian•debian_linux

    11.0

  • linux•linux

    ≥ 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 5c3097ede7835d3caf6543eb70ff689af4550cd2 | ≥ 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 058ad2b722812708fe90567875704ae36563e33b | ≥ 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < b10e0f868067c6f25bbfabdcf3e1e6432c24ca55 | ≥ 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 5badd56c711e2c8371d1670f9bd486697575423c | ≥ 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 9512510cee7d1becdb0e9413fdd3ab783e4e30ee | ≥ 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 4fe6f472f0beef4281e6f03bc38a910a33be663f | ≥ 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < 9843bcb187cb933861f7805022e6873905f669e4 | ≥ 842f16905dfc6743c1dd80c3d29b49ba3ab7f7c8, < cf16f408364efd8a68f39011a3b073c83a03612d | 2.6.35

  • linux•linux_kernel

    ≥ 2.6.35, < 5.10.241 | ≥ 5.11, < 5.15.190 | ≥ 5.16, < 6.1.149 | ≥ 6.2, < 6.6.103 | ≥ 6.7, < 6.12.43 | ≥ 6.13, < 6.15.11 | ≥ 6.16, < 6.16.2

References (11)