Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()[EOL][EOL]In snd_usb_get_audioformat_uac3(), the length value returned from[EOL]snd_usb_ctl_msg() is used directly for memory allocation without[EOL]validation. This length is controlled by the USB device.[EOL][EOL]The allocated buffer is cast to a uac3_cluster_header_descriptor[EOL]and its fields are accessed without verifying that the buffer[EOL]is large enough. If the device returns a smaller than expected[EOL]length, this leads to an out-of-bounds read.[EOL][EOL]Add a length check to ensure the buffer is large enough for[EOL]uac3_cluster_header_descriptor.

CREATE(Triage):(User=admin) [CVE-2025-38249 (https://nvd.nist.gov/vuln/detail/CVE-2025-38249)