CVE-2025-39760

23

FAUCET Score

CVE-2025-39760 is an out-of-bounds read vulnerability in the Linux kernel's USB core, specifically within the usb_parse_ss_endpoint_companion() function, affecting various Debian and Linux kernel versions. This flaw, rated High severity (CVSS 7.1), allows a local attacker with low privileges to potentially achieve high confidentiality and availability impacts. While there are no known public exploits or Metasploit modules, the vulnerability has garnered some community discussion and media coverage, indicating awareness. It is not currently listed on CISA's KEV catalog, suggesting no active exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.6.35, < 5.10.241CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 5.11, < 5.15.190CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 5.16, < 6.1.149CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 6.2, < 6.6.103CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 6.7, < 6.12.43CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::

CVSS Data

CVSS version used by this source: 3.1

7.1HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

1.8

Impact Score

5.2

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.16%

Probability of exploitation in next 30 days

EPSS Percentile

6.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0016 is in the 26th percentile among its peer group of 17,070 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (30)

microsoftpatch availablevia msrc

Product: 20412-17084Fixed in: 6.6.104.2-1

microsoftpatch availablevia msrc

Product: azl3 kernel 6.6.96.2-2 on Azure Linux 3.0Fixed in: 6.6.104.2-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: kernel-0:5.14.0-611.30.1.el9_7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: kernel-0:4.18.0-372.181.1.el8_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: kernel-0:4.18.0-372.181.1.el8_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: kernel-0:4.18.0-477.130.1.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: kernel-0:4.18.0-477.130.1.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: kernel-0:5.14.0-70.167.1.el9_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: kernel-rt-0:5.14.0-70.167.1.rt21.239.el9_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: kernel-0:5.14.0-284.158.1.el9_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: kernel-rt-0:5.14.0-284.158.1.rt14.443.el9_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: kernel-0:5.14.0-427.111.1.el9_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.6 Extended Update SupportFixed in: kernel-0:5.14.0-570.89.1.el9_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10.0 Extended Update SupportFixed in: kernel-0:6.12.0-55.61.1.el10_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: kernel-rt-0:4.18.0-553.100.1.rt7.441.el8_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: kernel-0:4.18.0-553.100.1.el8_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: kernel-0:4.18.0-193.187.1.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: kernel-0:4.18.0-305.186.1.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: kernel-0:4.18.0-305.186.1.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: kernel-0:4.18.0-372.181.1.el8_6

ubuntupatch availablevia ubuntu_usn

Product: linux-azure-fips (noble)Fixed in: 6.8.0-1046.52+fips1

ubuntupatch availablevia ubuntu_usn

Product: linux-azure (noble)Fixed in: 6.8.0-1046.52

ubuntupatch availablevia ubuntu_usn

Product: linux-azure-6.8 (jammy)Fixed in: 6.8.0-1051.57~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-ibm (noble)Fixed in: 6.8.0-1044.44

ubuntupatch availablevia ubuntu_usn

Product: linux-ibm-6.8 (jammy)Fixed in: 6.8.0-1044.44~22.04.1

ubuntupatch availablevia ubuntu_usn

Product: linux-xilinx (noble)Fixed in: 6.8.0-1023.24

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 10Fixed in: kernel

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: kernel

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: kernel-rt

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: kernel-rt

Vendor Advisories (7)

ubuntuUSN-8126-1

Linux kernel (Azure) vulnerabilities

ubuntuUSN-8074-2

Linux kernel (Azure FIPS) vulnerabilities

ubuntuUSN-8074-1

Linux kernel (Azure) vulnerabilities

ubuntuUSN-8052-2

Linux kernel (Xilinx) vulnerabilities

ubuntuUSN-8028-8

Linux kernel (IBM) vulnerabilities

redhatCVE-2025-39760Moderate

kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing

microsoft2025-Sep/CVE-2025-39760Moderate

usb: core: config: Prevent OOB read in SS endpoint companion parsing

References

cert-portal.siemens.com / productcert/html/ssa-032379.html

git.kernel.org / stable/c/058ad2b722812708fe90567875704ae36563e33b

Patch

git.kernel.org / stable/c/4fe6f472f0beef4281e6f03bc38a910a33be663f

Patch

git.kernel.org / stable/c/5badd56c711e2c8371d1670f9bd486697575423c

Patch

git.kernel.org / stable/c/5c3097ede7835d3caf6543eb70ff689af4550cd2

Patch

git.kernel.org / stable/c/9512510cee7d1becdb0e9413fdd3ab783e4e30ee

Patch

git.kernel.org / stable/c/9843bcb187cb933861f7805022e6873905f669e4

Patch

git.kernel.org / stable/c/b10e0f868067c6f25bbfabdcf3e1e6432c24ca55

Patch

git.kernel.org / stable/c/cf16f408364efd8a68f39011a3b073c83a03612d

Patch

lists.debian.org / debian-lts-announce/2025/10/msg00007.html

Third Party Advisory

lists.debian.org / debian-lts-announce/2025/10/msg00008.html

Third Party Advisory