NetSight
IP …
high7.1

CVE-2025-38249

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() In snd_usb_get_au…

Impact

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() In snd_usb_get_audioformat_uac3(), the length value returned from snd_usb_ctl_msg() is used directly for memory allocation without validation. This length is controlled by the USB device. The allocated buffer is cast to a uac3_cluster_header_descriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read. Add a length check to ensure the buffer is large enough for uac3_cluster_header_descriptor.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.17 before 5.4.296
from 5.5 before 5.10.240
from 5.11 before 5.15.187
from 5.16 before 6.1.143
from 6.2 before 6.6.96
from 6.7 before 6.12.36
DebianDebian Linux
Version 11.0

Weakness classification

CWE-125

References