CVE-2025-40004: Linux 6.12

Affected technology

Linux · a3be076dc174d9022a71a12554feb4c97b5c4d5c to before 0da18d49f874d444ad83c8a546fa33bfcf2f582c, a3be076dc174d9022a71a12554feb4c97b5c4d5c to before df8462f0fc045b4475dc494a5787a03c972ba2a2, a3be076dc174d9022a71a12554feb4c97b5c4d5c to before c04db81cd0288dfc68b7a0f7d09bd49b40bba451
Linux

Linux · 6.12
Linux

Component: Not specified by the source
File: net/9p/trans_usbg.c

What an attacker can do

The source says the issue occurs because: - usb9pfs_rx_header() validates only the declared size in packet header - usb9pfs_rx_complete() uses req->actual (actual received bytes) for memcpy This allows an attacker to craft packets with small declared size (bypassing validation) but large actual payload (triggering overflow in memcpy).