Buffer Overflow Vulnerability in Linux Kernel's USB 9pfs Transport Layer

CVE-2025-40004

What is CVE-2025-40004?

A buffer overflow vulnerability has been identified in the USB 9pfs transport layer of the Linux kernel, arising from improper size validation during packet header parsing and actual data copying. An attacker can exploit this vulnerability by sending a maliciously crafted USB packet that declares a smaller size while containing a larger payload. This inconsistency leads to buffer overflow during data copying operations, posing significant risks to system stability and security. It is crucial for users to ensure that their installations are updated to patched versions to mitigate these risks.

References