CVE-2025-38249

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

In snd_usb_get_audioformat_uac3(), the length value returned from snd_usb_ctl_msg() is used directly for memory allocation without validation. This length is controlled by the USB device.

The allocated buffer is cast to a uac3_cluster_header_descriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read.

Add a length check to ensure the buffer is large enough for uac3_cluster_header_descriptor.

The vulnerability in snd_usb_get_audioformat_uac3() stems from an out-of-bounds read caused by a lack of validation on the length of a USB descriptor returned by the device. A malicious USB device can supply a shorter-than-expected buffer, leading to unauthorized memory access. For the CVSS the Privileges Required is Low. Although no system privileges are required, the attacker must be able to plug in a crafted USB device, which typically implies physical access or control over a local port.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.