CVE-2025-40345: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40345 is a heap memory corruption vulnerability in the Linux kernel's USB storage driver (usb/storage/sddr55) caused by insufficient validation of physical block addresses (PBAs) returned by USB storage devices. Discovered by the Atuin Automated Vulnerability Discovery Engine and published on December 12, 2025, it affects Linux kernel versions across multiple stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.17.x) as well as Microsoft Azure Linux kernel 6.6.117.1-1. It carries a CVSS v3.1 base score of 7.3 (High) (Microsoft MSRC, Feedly).

The root cause is improper input validation (CWE-20) in the sddr55 USB storage driver. The new_pba value is derived from the status packet returned by a USB storage device after each write operation; the driver fails to verify that this value falls within the valid range defined by info->capacity. A malicious or specially crafted USB device can return an out-of-bounds new_pba, causing the driver to walk past the end of the pba_to_lba[] mapping array and corrupt adjacent heap memory. Exploitation requires local physical access to connect a rogue USB device, and the attacker needs only low-level privileges (Microsoft MSRC, Feedly).

Successful exploitation can result in heap memory corruption, which may lead to privilege escalation, information disclosure (low confidentiality impact), or denial of service (system crash/instability). The integrity and availability impacts are rated High, while confidentiality impact is Low. The attack is constrained to the local system and requires physical USB access, limiting the scope of lateral movement, but a successful privilege escalation could allow an attacker to gain full kernel-level control of the affected host (Microsoft MSRC, Feedly).

1. Prepare a malicious USB device: Craft or program a USB storage device (e.g., using a microcontroller such as a Raspberry Pi Pico or a BadUSB-capable device) to emulate an SDDR-55 compatible flash storage device.
2. Modify status packet responses: Configure the device firmware to return an out-of-bounds new_pba value in the status packet sent after each write operation — specifically, a value exceeding the block count computed from info->capacity.
3. Connect the device: Physically connect the malicious USB device to a target Linux system running a vulnerable kernel version (prior to the patched releases).
4. Trigger a write operation: Initiate a write to the USB storage device (e.g., by mounting it and copying files), causing the sddr55 driver to process the crafted status packet.
5. Achieve heap corruption: The driver reads the out-of-bounds new_pba and writes to memory beyond the pba_to_lba[] array, corrupting heap memory. Depending on heap layout, this may be leveraged for privilege escalation or to crash the kernel (Feedly, Microsoft MSRC).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing USB storage errors, unexpected kernel panics, or memory corruption messages related to the sddr55 driver after connecting a USB device.
• Process/System Behavior: Unexpected kernel oops or system crashes (kernel panic) shortly after a USB storage device is connected and a write operation is performed.
• File System: Unexpected files or processes appearing after USB device connection, potentially indicating post-exploitation activity following a successful privilege escalation.
• USB Events: Unusual or unrecognized USB device identifiers appearing in lsusb output or udev logs that do not correspond to known legitimate devices.

Patches have been released across all affected Linux kernel stable branches: 5.10.247, 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18. Microsoft released a patch for Azure Linux kernel 6.6.117.1-1 on December 14, 2025. Distribution-specific updates are available from Ubuntu (USN-8096-x, USN-8094-x, USN-8152-1), Debian (DLA-4436-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-112), and Oracle Linux. As a workaround where patching is not immediately possible, restrict physical USB port access using port blockers or USB device control policies to prevent untrusted devices from being connected (Microsoft MSRC, Feedly).

The vulnerability was discovered by the Atuin Automated Vulnerability Discovery Engine, highlighting the growing role of automated tooling in kernel vulnerability research. Coverage has been limited to standard vulnerability tracking outlets (VulnDB, CVEFeed, CIRCL), with no notable researcher commentary or significant social media discussion beyond automated CVE broadcast accounts (Feedly).