CVE-2025-40275

kernel: ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd

Loading…

Severity

Low

Red Hat Product Security

4.3

CVSS 3.1

Review impact separately from score.

Published · December 6, 2025

Updated · June 30, 2026

Description

A null pointer dereference was found in the USB audio driver in the Linux kernel. For UAC3 devices, snd_usb_mixer_controls_badd() does not check if usb_ifnum_to_if() returns NULL before dereferencing the result. A malicious USB device with crafted descriptors can trigger this crash.

Statement

Physical access is required to connect a malicious USB device. The impact is limited to kernel crash (denial of service). This was discovered through syzkaller fuzzing with crafted USB descriptors.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.3
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-252 · Unchecked Return Value