In the Linux kernel, the following vulnerability has been resolved:
usb: core: config: Prevent OOB read in SS endpoint companion parsing
usbparsessendpointcompanion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size.
Fix this up by checking the size first before looking at any of the fields in the descriptor.
[
{
"id": "CVE-2025-39760-07cbc44b",
"target": {
"function": "usb_parse_ss_endpoint_companion",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 3413.0,
"function_hash": "69600916225512296466542341797020735816"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fe6f472f0beef4281e6f03bc38a910a33be663f"
},
{
"id": "CVE-2025-39760-105e45a8",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"134760299589552358318479241818994775762",
"210063720436794227618697525931032859193",
"269693899740270375060670821787733430642",
"271879653057161808708186224914131916412",
"57838079466850717812232973188188754792"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fe6f472f0beef4281e6f03bc38a910a33be663f"
},
{
"id": "CVE-2025-39760-13b540af",
"target": {
"function": "usb_parse_ss_endpoint_companion",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 3413.0,
"function_hash": "69600916225512296466542341797020735816"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf16f408364efd8a68f39011a3b073c83a03612d"
},
{
"id": "CVE-2025-39760-1f628556",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"134760299589552358318479241818994775762",
"210063720436794227618697525931032859193",
"269693899740270375060670821787733430642",
"271879653057161808708186224914131916412",
"57838079466850717812232973188188754792"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@058ad2b722812708fe90567875704ae36563e33b"
},
{
"id": "CVE-2025-39760-1f9e742b",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"134760299589552358318479241818994775762",
"210063720436794227618697525931032859193",
"269693899740270375060670821787733430642",
"271879653057161808708186224914131916412",
"57838079466850717812232973188188754792"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b10e0f868067c6f25bbfabdcf3e1e6432c24ca55"
},
{
"id": "CVE-2025-39760-47247ac7",
"target": {
"function": "usb_parse_ss_endpoint_companion",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 3413.0,
"function_hash": "69600916225512296466542341797020735816"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9843bcb187cb933861f7805022e6873905f669e4"
},
{
"id": "CVE-2025-39760-65d9ac9c",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"134760299589552358318479241818994775762",
"210063720436794227618697525931032859193",
"269693899740270375060670821787733430642",
"271879653057161808708186224914131916412",
"57838079466850717812232973188188754792"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c3097ede7835d3caf6543eb70ff689af4550cd2"
},
{
"id": "CVE-2025-39760-8b59533d",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"134760299589552358318479241818994775762",
"210063720436794227618697525931032859193",
"269693899740270375060670821787733430642",
"271879653057161808708186224914131916412",
"57838079466850717812232973188188754792"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9843bcb187cb933861f7805022e6873905f669e4"
},
{
"id": "CVE-2025-39760-a418497d",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"134760299589552358318479241818994775762",
"210063720436794227618697525931032859193",
"269693899740270375060670821787733430642",
"271879653057161808708186224914131916412",
"57838079466850717812232973188188754792"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf16f408364efd8a68f39011a3b073c83a03612d"
},
{
"id": "CVE-2025-39760-a451d70a",
"target": {
"function": "usb_parse_ss_endpoint_companion",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 3413.0,
"function_hash": "69600916225512296466542341797020735816"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c3097ede7835d3caf6543eb70ff689af4550cd2"
},
{
"id": "CVE-2025-39760-a79d820a",
"target": {
"function": "usb_parse_ss_endpoint_companion",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 3413.0,
"function_hash": "69600916225512296466542341797020735816"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@058ad2b722812708fe90567875704ae36563e33b"
},
{
"id": "CVE-2025-39760-acfc0127",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"134760299589552358318479241818994775762",
"210063720436794227618697525931032859193",
"269693899740270375060670821787733430642",
"271879653057161808708186224914131916412",
"57838079466850717812232973188188754792"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5badd56c711e2c8371d1670f9bd486697575423c"
},
{
"id": "CVE-2025-39760-d5ce8b2a",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"134760299589552358318479241818994775762",
"210063720436794227618697525931032859193",
"269693899740270375060670821787733430642",
"271879653057161808708186224914131916412",
"57838079466850717812232973188188754792"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9512510cee7d1becdb0e9413fdd3ab783e4e30ee"
},
{
"id": "CVE-2025-39760-d66ffc6e",
"target": {
"function": "usb_parse_ss_endpoint_companion",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 3413.0,
"function_hash": "69600916225512296466542341797020735816"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9512510cee7d1becdb0e9413fdd3ab783e4e30ee"
},
{
"id": "CVE-2025-39760-df8f04e1",
"target": {
"function": "usb_parse_ss_endpoint_companion",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 3413.0,
"function_hash": "69600916225512296466542341797020735816"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b10e0f868067c6f25bbfabdcf3e1e6432c24ca55"
},
{
"id": "CVE-2025-39760-e0236b1d",
"target": {
"function": "usb_parse_ss_endpoint_companion",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 3413.0,
"function_hash": "69600916225512296466542341797020735816"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5badd56c711e2c8371d1670f9bd486697575423c"
}
]