---
id: CVE-2025-40345
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: storage: sddr55: Reject out-of-bound new_pba

  Discovered by Atuin - Automated Vulnerability Discovery Engine.

  new_pba comes from the status packet returned after …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: storage: sddr55: Reject out-of-bound new_pba

  Discovered by Atuin - Automated Vulnerability Discovery Engine.

  new_pba comes from the status packet returned after …
severity: none
published: '2025-12-12'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-40345'
references:
  - url: 'https://git.kernel.org/stable/c/04a8a6393f3f2f471e05eacca33282dd30b01432'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/26e9b5da3231da7dc357b363883b5b7b51a64092'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5ebe8d479aaf4f41ac35e6955332304193c646f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a20f1dd19d21dcb70140ea5a71b1f8cbe0c7e68f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/aa64e0e17e3a5991a25e6a46007770c629039869'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b59d4fda7e7d0aff1043a7f742487cb829f5aac1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d00a6c04a502cd52425dbf35588732c652b16490'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-253495.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.00197
epssPercentile: 0.08751
ingestedAt: '2026-10-14T13:30:58.420Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: sddr55: Reject out-of-bound new_pba

Discovered by Atuin - Automated Vulnerability Discovery Engine.

new_pba comes from the status packet returned after each write.
A bogus device could report values beyond the block count derived
from info->capacity, letting the driver walk off the end of
pba_to_lba[] and corrupt heap memory.

Reject PBAs that exceed the computed block count and fail the
transfer so we avoid touching out-of-range mapping entries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.