In the Linux kernel, the following vulnerability has been resolved:
scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow
A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in targetlugpmembersshow function located in /drivers/target/targetcoreconfigfs.c. This buffer is allocated with size LUGROUPNAME_BUF (256 bytes).
snprintf(...) formats multiple strings into buf with the HBA name (hba->hbagroup.cgitem), a slash character, a devicename (dev-> devgroup.cgitem) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes.
Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error.
An additional check of the return value of snprintf() can avoid this buffer overflow.
[
{
"id": "CVE-2025-39998-08fd15da",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "101313976396423867016105534652351337166",
"length": 735.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b292286949588bd2818e66ff102db278de8dd26"
},
{
"id": "CVE-2025-39998-0e32143a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "101313976396423867016105534652351337166",
"length": 735.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f03aa5e39da7d045615b3951d2a6ca1d7132f881"
},
{
"id": "CVE-2025-39998-104100e6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "101313976396423867016105534652351337166",
"length": 735.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53c6351597e6a17ec6619f6f060d54128cb9a187"
},
{
"id": "CVE-2025-39998-7590d5b7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53c6351597e6a17ec6619f6f060d54128cb9a187"
},
{
"id": "CVE-2025-39998-79aad3a9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "101313976396423867016105534652351337166",
"length": 735.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27e06650a5eafe832a90fd2604f0c5e920857fae"
},
{
"id": "CVE-2025-39998-8db9171e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "125664674911209353867437956397159738024",
"length": 772.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6eeee5dc0d9221ff96d1b229b1d0222c8871b84"
},
{
"id": "CVE-2025-39998-a0693e54",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "101313976396423867016105534652351337166",
"length": 735.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a150275831b765b0f1de8b8ff52ec5c6933ac15d"
},
{
"id": "CVE-2025-39998-a134a728",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a150275831b765b0f1de8b8ff52ec5c6933ac15d"
},
{
"id": "CVE-2025-39998-a53e1f58",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27e06650a5eafe832a90fd2604f0c5e920857fae"
},
{
"id": "CVE-2025-39998-b2cce0e0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "101313976396423867016105534652351337166",
"length": 735.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddc79fba132b807ff775467acceaf48b456e008b"
},
{
"id": "CVE-2025-39998-c24a7e34",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f03aa5e39da7d045615b3951d2a6ca1d7132f881"
},
{
"id": "CVE-2025-39998-c2ddcac6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@764a91e2fc9639e07aac93bc70e387e6b1e33084"
},
{
"id": "CVE-2025-39998-c7dc19fc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "101313976396423867016105534652351337166",
"length": 735.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e73fe0eefac3e15bf88fb5b4afae4c76215ee4d4"
},
{
"id": "CVE-2025-39998-cb01c7a0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e73fe0eefac3e15bf88fb5b4afae4c76215ee4d4"
},
{
"id": "CVE-2025-39998-de7b62d5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/target/target_core_configfs.c",
"function": "target_lu_gp_members_show"
},
"digest": {
"function_hash": "125664674911209353867437956397159738024",
"length": 772.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@764a91e2fc9639e07aac93bc70e387e6b1e33084"
},
{
"id": "CVE-2025-39998-e21e464a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddc79fba132b807ff775467acceaf48b456e008b"
},
{
"id": "CVE-2025-39998-eb1175d3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b292286949588bd2818e66ff102db278de8dd26"
},
{
"id": "CVE-2025-39998-ff534b98",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/target/target_core_configfs.c"
},
"digest": {
"line_hashes": [
"2768882323123760022348793590406655102",
"308164504475445563516303813069073740822",
"4849208948730111912043862375569773685",
"247449351418702287523906342118902977078"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6eeee5dc0d9221ff96d1b229b1d0222c8871b84"
}
]