CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Vulnerability summary
CVE-2025-39998 is a high (CVSS 7.1) vulnerability in linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.8% of scored vulnerabilities.
Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 39 · Related 34Timeline
- 15-10-2025PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes). snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes. Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error. An additional check of the return value of snprintf() can avoid this buffer overflow.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu148 products
- linuxAll versions (No fix recorded) | < 5.15.0-170.180 | < 6.8.0-106.106 | < 6.17.0-6.6
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1100.107 | < 6.8.0-1050.53 | < 6.17.0-1003.3
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linux< 6.1.158-1 | < 6.12.57-1 | < 6.16.11-1
Linux1 product
- linux≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < e6eeee5dc0d9221ff96d1b229b1d0222c8871b84 | ≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < 764a91e2fc9639e07aac93bc70e387e6b1e33084 | ≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < ddc79fba132b807ff775467acceaf48b456e008b | ≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < e73fe0eefac3e15bf88fb5b4afae4c76215ee4d4 | ≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < f03aa5e39da7d045615b3951d2a6ca1d7132f881 | ≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < 53c6351597e6a17ec6619f6f060d54128cb9a187 | ≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < 4b292286949588bd2818e66ff102db278de8dd26 | ≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < a150275831b765b0f1de8b8ff52ec5c6933ac15d | ≥ c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5, < 27e06650a5eafe832a90fd2604f0c5e920857fae | 2.6.38
3 vendors · 150 products
