AZL-72332
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-72332.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-72332
- Upstream
- Published
- 2025-12-12T18:15:39Z
- Modified
- 2026-04-01T05:22:09.038735Z
- Summary
- CVE-2025-40345 affecting package kernel for versions less than 6.6.119.3-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: sddr55: Reject out-of-bound new_pba
Discovered by Atuin - Automated Vulnerability Discovery Engine.
newpba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pbato_lba[] and corrupt heap memory.
Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries.
- References