https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:15:07 +0000 https://vulnerability.circl.lu/vuln/cve-2025-40004 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/9p: Fix buffer overflow in USB transport layer</p> <p>A buffer overflow vulnerability exists in the USB 9pfs transport layer where inconsistent size validation between packet header parsing and actual data copying allows a malicious USB host to overflow heap buffers.</p> <p>The issue occurs because: - usb9pfs_rx_header() validates only the declared size in packet header - usb9pfs_rx_complete() uses req-&gt;actual (actual received bytes) for memcpy</p> <p>This allows an attacker to craft packets with small declared size (bypassing validation) but large actual payload (triggering overflow in memcpy).</p> <p>Add validation in usb9pfs_rx_complete() to ensure req-&gt;actual does not exceed the buffer capacity before copying data.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/9p: Fix buffer overflow in USB transport layer</p> <p>A buffer overflow vulnerability exists in the USB 9pfs transport layer where inconsistent size validation between packet header parsing and actual data copying allows a malicious USB host to overflow heap buffers.</p> <p>The issue occurs because: - usb9pfs_rx_header() validates only the declared size in packet header - usb9pfs_rx_complete() uses req-&gt;actual (actual received bytes) for memcpy</p> <p>This allows an attacker to craft packets with small declared size (bypassing validation) but large actual payload (triggering overflow in memcpy).</p> <p>Add validation in usb9pfs_rx_complete() to ensure req-&gt;actual does not exceed the buffer capacity before copying data.</p> https://vulnerability.circl.lu/vuln/cve-2025-40004