VDB
DEBIAN-CVE-2025-39760
DEBIAN-CVE-2025-39760
PUBLISHED
CVSS 7.099999904632568 HIGH
In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | linux | 5.10.84-1, 5.10.70-1, 5.10.70-1 |
| Debian:12 | linux | 6.1.38-2, 6.1.106-3, 0 |
| Debian:14 | linux | 6.13.7-1, 6.15.5-1~exp1, * |
| Debian:11 | linux-6.1 | *, 0, 6.1.106-3~deb11u1 |
| Debian:13 | linux | 6.12.38-1, 0, 6.12.41-1 |
Exploit Intelligence
- 4081.3.6.yml (github-poc)
Timeline
- Sep 11, 2025 CVE Published
- Apr 28, 2026 CVE Updated