Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-40269

Опубликовано: 06 дек. 2025
Источник: redhat
CVSS3: 7.3
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the actually used packet sizes are determined only by the rate and the PPS, which may be bigger than the size limit above. This results in a buffer overflow, as reported by syzbot. Basically when the limit is smaller than the calculated packet size, it implies that something is wrong, most likely a weird USB descriptor. So the best option would be just to return an error at the parameter setup time before doing any further operations. This patch introduces such a sanity check, and returns -EINVAL when the packet size is greater than maxpacksize. The comparison with ep->packsize[1] alone should suffice since it's always equal or greater than ep->packsize[0].

A flaw was found in the ALSA USB audio driver of the Linux kernel. This vulnerability, a buffer overflow, occurs when the size of the Pulse-Code Modulation (PCM) stream data packets exceeds the maximum allowed by the USB descriptor. A local attacker could exploit this by providing specially crafted USB audio device parameters, causing the PCM transfer buffer to overflow. This could lead to sensitive information disclosure and potentially result in a denial of service (DoS).

Меры по смягчению последствий

To mitigate this issue, prevent the snd_usb_audio kernel module from loading if USB audio functionality is not required. Create a file /etc/modprobe.d/disable-snd-usb-audio.conf with the following content: install snd_usb_audio /bin/true After creating the file, a system reboot is required for the changes to take effect. This action will disable all USB audio device functionality.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6kernelUnder investigation
Red Hat Enterprise Linux 7kernelNot affected
Red Hat Enterprise Linux 7kernel-rtAffected
Red Hat Enterprise Linux 9kernel-rtAffected
Red Hat Enterprise Linux 10kernelFixedRHSA-2026:272116.02.2026
Red Hat Enterprise Linux 10.0 Extended Update SupportkernelFixedRHSA-2026:276116.02.2026
Red Hat Enterprise Linux 8kernel-rtFixedRHSA-2026:237810.02.2026
Red Hat Enterprise Linux 8kernelFixedRHSA-2026:226409.02.2026
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportkernelFixedRHSA-2026:424311.03.2026
Red Hat Enterprise Linux 8.6 Telecommunications Update ServicekernelFixedRHSA-2026:424311.03.2026

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-131
https://bugzilla.redhat.com/show_bug.cgi?id=2419919kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service

EPSS

Процентиль: 37%
0.00159
Низкий

7.3 High

CVSS3

Связанные уязвимости

ubuntu
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the actually used packet sizes are determined only by the rate and the PPS, which may be bigger than the size limit above. This results in a buffer overflow, as reported by syzbot. Basically when the limit is smaller than the calculated packet size, it implies that something is wrong, most likely a weird USB descriptor. So the best option would be just to return an error at the parameter setup time before doing any further operations. This patch introduces such a sanity check, and returns -EINVAL when the packet size is greater than maxpacksize. The comparison with ep->packsize[1] alone should suffice since it'...

nvd
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the actually used packet sizes are determined only by the rate and the PPS, which may be bigger than the size limit above. This results in a buffer overflow, as reported by syzbot. Basically when the limit is smaller than the calculated packet size, it implies that something is wrong, most likely a weird USB descriptor. So the best option would be just to return an error at the parameter setup time before doing any further operations. This patch introduces such a sanity check, and returns -EINVAL when the packet size is greater than maxpacksize. The comparison with ep->packsize[1] alone should suffice since it

CVSS3: 4.3
msrc
4 месяца назад

ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

debian
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: A ...

github
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the actually used packet sizes are determined only by the rate and the PPS, which may be bigger than the size limit above. This results in a buffer overflow, as reported by syzbot. Basically when the limit is smaller than the calculated packet size, it implies that something is wrong, most likely a weird USB descriptor. So the best option would be just to return an error at the parameter setup time before doing any further operations. This patch introduces such a sanity check, and returns -EINVAL when the packet size is greater than maxpacksize. The comparison with ep->packsize[1] alone should suffice since...

EPSS

Процентиль: 37%
0.00159
Низкий

7.3 High

CVSS3