CVE-2025-39760: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-39760 Overview

CVE-2025-39760 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's USB core subsystem. The flaw resides in usb_parse_ss_endpoint_companion(), which parses SuperSpeed (SS) endpoint companion descriptors during USB device configuration. The function checks the descriptor type field before validating the descriptor length, allowing a read past the buffer boundary when a crafted or malformed descriptor is present. The vulnerability affects the mainline Linux kernel and downstream distributions including Debian. Exploitation requires local access and low privileges, and impacts confidentiality and availability without altering integrity.

Critical Impact
A local attacker with the ability to attach a malicious or malformed USB device can trigger an out-of-bounds read in kernel memory, leading to information disclosure or a kernel crash (denial of service).

Affected Products

Linux Kernel (multiple stable branches prior to the patch commits)
Debian Linux 11.0
Siemens products bundling affected kernel versions (per advisory SSA-032379)

Discovery Timeline

2025-09-11 - CVE-2025-39760 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39760

Vulnerability Analysis

The defect exists in drivers/usb/core/config.c within usb_parse_ss_endpoint_companion(). This function processes USB 3.x SuperSpeed endpoint companion descriptors, which follow standard endpoint descriptors during device enumeration. Before the fix, the parser inspected the bDescriptorType field of the incoming descriptor before verifying that the remaining buffer was large enough to contain that field. When a device supplies a truncated descriptor whose declared size is smaller than the header, the type check reads memory outside of the parse buffer.

This triggers a kernel out-of-bounds read [CWE-125]. Depending on the surrounding memory layout, the read can either leak kernel data into subsequent parsing decisions or fault and crash the kernel. Because the parser runs during USB enumeration, the code path executes early in device attachment, before any userspace policy can filter the device.

Root Cause

The root cause is an ordering error in descriptor validation. The parser performs semantic checks on descriptor contents before confirming the descriptor length is sufficient. The upstream fix, applied across multiple stable branches (commits 058ad2b7, 4fe6f472, 5badd56c, 5c3097ed, 9512510c, 9843bcb1, b10e0f86, and cf16f408), reorders the logic so that the size check occurs before any field access.

Attack Vector

An attacker requires local access to the target system and the ability to attach a USB device. This can be a physical device presented at a USB port, a programmable device such as a Facedancer or Raspberry Pi acting as a USB gadget, or a malicious device passed through to a virtual machine. No user interaction beyond device insertion is required, and the affected code runs in kernel context during enumeration.

No verified public exploit code is available. Refer to the upstream kernel commits for the exact parsing logic and fix.

Detection Methods for CVE-2025-39760

Indicators of Compromise

Unexpected kernel oops or panic messages referencing usb_parse_ss_endpoint_companion or usb_parse_configuration in dmesg or /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports of out-of-bounds reads originating from drivers/usb/core/config.c on instrumented builds.
USB enumeration failures or repeated re-enumeration attempts following insertion of an unknown device.

Detection Strategies

Monitor kernel ring buffer output for parsing errors, warnings, or crashes tied to USB descriptor handling.
Audit udev events and correlate device insertion timestamps against kernel faults to identify anomalous USB devices.
On engineering or high-risk systems, enable KASAN and CONFIG_USB_ANNOUNCE_NEW_DEVICES to surface descriptor anomalies during testing.

Monitoring Recommendations

Forward kern.log, syslog, and journald output to a centralized logging or SIEM platform and alert on kernel panics and USB subsystem faults.
Track installed kernel package versions across the fleet to identify hosts still running vulnerable builds.
Log all USB device attach events, including vendor and product IDs, for later correlation with suspected incidents.

How to Mitigate CVE-2025-39760

Immediate Actions Required

Apply the vendor kernel update on all affected hosts, prioritizing multi-user systems, kiosks, and endpoints in physically accessible locations.
Reboot systems after patching so the fixed kernel is loaded; live-patch delivery may be available on some distributions.
Restrict physical access to USB ports on servers and shared workstations until patches are deployed.

Patch Information

The fix is included in the Linux stable tree via commits 058ad2b7, 4fe6f472, 5badd56c, 5c3097ed, 9512510c, 9843bcb1, b10e0f86, and cf16f408. Debian users should apply the updates announced in Debian LTS Announcement #7 and Debian LTS Announcement #8. Siemens customers should consult Siemens Product Security Advisory SSA-032379 for product-specific guidance.

Workarounds

Disable USB host controller drivers (for example, xhci_hcd) on systems that do not require USB, using module blacklists in /etc/modprobe.d/.
Use USBGuard or equivalent policy tools to restrict which USB devices are permitted to enumerate.
Enforce full-disk encryption and lock USB ports at the firmware or chassis level for high-value systems where physical access is a concern.

bash

# Configuration example: block the xhci_hcd module on systems without USB 3.x needs
echo "install xhci_hcd /bin/true" | sudo tee /etc/modprobe.d/disable-xhci.conf

# Or restrict USB device enumeration with USBGuard
sudo apt-get install usbguard
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard