NetSight
IP …
high7.1

CVE-2025-39760

In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_…

Impact

In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.35 before 5.10.241
from 5.11 before 5.15.190
from 5.16 before 6.1.149
from 6.2 before 6.6.103
from 6.7 before 6.12.43
from 6.13 before 6.15.11
DebianDebian Linux
Version 11.0

Weakness classification

CWE-125

References