CVE-2025-40345

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: sddr55: Reject out-of-bound new_pba

Discovered by Atuin - Automated Vulnerability Discovery Engine.

new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory.

Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries.

The sddr55 USB mass-storage driver trusted new_pba reported by the device and used it as an index into pba_to_lba[] without proper bounds checking, resulting in a heap out-of-bounds write in the kernel. A malicious USB device can return an oversized new_pba to corrupt kernel memory, leading to DoS and possibly privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module usb-storage from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.