CVE-2025-40345

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: sddr55: Reject out-of-bound new_pba

Discovered by Atuin - Automated Vulnerability Discovery Engine.

new_pba comes from the status packet returned after each write.

A bogus device could report values beyond the block count derived

from info->capacity, letting the driver walk off the end of

pba_to_lba[] and corrupt heap memory.

Reject PBAs that exceed the computed block count and fail the

transfer so we avoid touching out-of-range mapping entries.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References