CVE-2025-39760

What it actually does

Out-of-bounds read in usb_parse_ss_endpoint_companion() caused by validating USB descriptor type before checking length, allowing access beyond allocated buffer.

Why it matters to the business

Kernel memory corruption on Linux systems handling USB devices can cause crashes, information leaks, or privilege escalation, impacting containerized and general-purpose deployments with moderate downstream prevalence.

How an attack unfolds

An attacker supplies a crafted USB device descriptor that passes initial type checks but triggers an oversized read; local or physical access (including via containers) allows the malformed data to be processed during enumeration, with observed campaigns such as VMSCAPE targeting similar kernel paths for escalation.

How to fix it

Update the Linux kernel to commit 5c3097ede7835d3caf6543eb70ff689af4550cd2 or later; for cargo-c (MinimOS) upgrade to version 0.10.15-r1. Reboot affected systems after patching.

How to confirm the fix worked

Verify kernel source or package version contains the fix commit; attempt to reproduce with a USB descriptor that previously caused the OOB read and confirm no crash or leak occurs; review dmesg for USB parsing warnings.

Typical attack path

1. Provide malformed SuperSpeed endpoint companion descriptor via USB device or emulated interface
2. Trigger usb_parse_ss_endpoint_companion during device enumeration
3. Perform out-of-bounds read leading to kernel memory disclosure or crash
4. Leverage disclosed data or instability for further privilege escalation

How to detect it

Search kernel logs and USB subsystem traces for unexpected descriptor parsing errors or OOB access warnings around device enumeration events; correlate with container runtime activity on systems exposed to untrusted USB or virtual devices.

What your security team should do

• Apply the referenced kernel commit or cargo-c update immediately on all exposed systems
• Restrict untrusted USB device attachment until patched
• Monitor for related container privilege-escalation activity reported under VMSCAPE and similar campaigns
• Test patches in staging environments before broad deployment