CVE-2025-40004: net/9p: Fix buffer overflow in USB transport layer
In the Linux kernel, the following vulnerability has been resolved:
net/9p: Fix buffer overflow in USB transport layer
A buffer overflow vulnerability exists in the USB 9pfs transport layer where inconsistent size validation between packet header parsing and actual data copying allows a malicious USB host to overflow heap buffers.
The issue occurs because: - usb9pfsrxheader() validates only the declared size in packet header - usb9pfsrxcomplete() uses req->actual (actual received bytes) for memcpy
This allows an attacker to craft packets with small declared size (bypassing validation) but large actual payload (triggering overflow in memcpy).
Add validation in usb9pfsrxcomplete() to ensure req->actual does not exceed the buffer capacity before copying data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add validation in usb9pfs_rx_complete() to ensure req->actual does not exceed the buffer capacity before copying data with memcpy.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40004?
CVE-2025-40004 is considered a critical severity vulnerability due to its potential to cause buffer overflows.
How do I fix CVE-2025-40004?
To fix CVE-2025-40004, users should update their Linux kernel to the latest patched version released by the maintainers.
What systems are affected by CVE-2025-40004?
CVE-2025-40004 affects systems running vulnerable versions of the Linux kernel that utilize the USB 9pfs transport layer.
What type of vulnerability is CVE-2025-40004?
CVE-2025-40004 is a buffer overflow vulnerability that arises from inconsistent size validation.
Is CVE-2025-40004 exploitable remotely?
Yes, CVE-2025-40004 can potentially be exploited remotely by an attacker, allowing unauthorized access or control.