CVE-2025-39998

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes). snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes. Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error. An additional check of the return value of snprintf() can avoid this buffer overflow.

Severity

HIGH

CVSS score

7.1 (v3.1)

Vulnerability status

Deferred

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2025-10-15 08:15:38.077000

Last modified

2026-10-19 21:10:00.160000

View original CVE JSON

{
  "id": "CVE-2025-39998",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-10-15T08:15:38.077",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: target_core_configfs: Add length check to avoid buffer overflow\n\nA buffer overflow arises from the usage of snprintf to write into the\nbuffer \"buf\" in target_lu_gp_members_show function located in\n/drivers/target/target_core_configfs.c. This buffer is allocated with\nsize LU_GROUP_NAME_BUF (256 bytes).\n\nsnprintf(...) formats multiple strings into buf with the HBA name\n(hba->hba_group.cg_item), a slash character, a devicename (dev->\ndev_group.cg_item) and a newline character, the total formatted string\nlength may exceed the buffer size of 256 bytes.\n\nSince snprintf() returns the total number of bytes that would have been\nwritten (the length of %s/%sn ), this value may exceed the buffer length\n(256 bytes) passed to memcpy(), this will ultimately cause function\nmemcpy reporting a buffer overflow error.\n\nAn additional check of the return value of snprintf() can avoid this\nbuffer overflow."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: target: target_core_configfs: Añadir comprobación de longitud para evitar desbordamiento de búfer\n\nUn desbordamiento de búfer surge del uso de snprintf para escribir en el búfer 'buf' en la función target_lu_gp_members_show ubicada en /drivers/target/target_core_configfs.c. Este búfer se asigna con un tamaño de LU_GROUP_NAME_BUF (256 bytes).\n\nsnprintf(...) formatea múltiples cadenas en buf con el nombre del HBA (hba->hba_group.cg_item), un carácter de barra, un nombre de dispositivo (dev->dev_group.cg_item) y un carácter de nueva línea, la longitud total de la cadena formateada puede exceder el tamaño del búfer de 256 bytes.\n\nDado que snprintf() devuelve el número total de bytes que se habrían escrito (la longitud de %s/%sn ), este valor puede exceder la longitud del búfer (256 bytes) pasada a memcpy(), lo que finalmente hará que la función memcpy informe un error de desbordamiento de búfer.\n\nUna comprobación adicional del valor de retorno de snprintf() puede evitar este desbordamiento de búfer."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/target/target_core_configfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "e6eeee5dc0d9221ff96d1b229b1d0222c8871b84",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "764a91e2fc9639e07aac93bc70e387e6b1e33084",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "ddc79fba132b807ff775467acceaf48b456e008b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "e73fe0eefac3e15bf88fb5b4afae4c76215ee4d4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "f03aa5e39da7d045615b3951d2a6ca1d7132f881",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "53c6351597e6a17ec6619f6f060d54128cb9a187",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "4b292286949588bd2818e66ff102db278de8dd26",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "a150275831b765b0f1de8b8ff52ec5c6933ac15d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "lessThan": "27e06650a5eafe832a90fd2604f0c5e920857fae",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/target/target_core_configfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "2.6.38",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "2.6.38",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.4.301",
              "lessThanOrEqual": "5.4.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.246",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.195",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.156",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.110",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.51",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.16.11",
              "lessThanOrEqual": "6.16.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.1",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-15T21:56:02.868317Z",
          "id": "CVE-2025-39998",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/27e06650a5eafe832a90fd2604f0c5e920857fae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4b292286949588bd2818e66ff102db278de8dd26",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/53c6351597e6a17ec6619f6f060d54128cb9a187",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/764a91e2fc9639e07aac93bc70e387e6b1e33084",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a150275831b765b0f1de8b8ff52ec5c6933ac15d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ddc79fba132b807ff775467acceaf48b456e008b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e6eeee5dc0d9221ff96d1b229b1d0222c8871b84",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e73fe0eefac3e15bf88fb5b4afae4c76215ee4d4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f03aa5e39da7d045615b3951d2a6ca1d7132f881",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}