CVE-2025-68347

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provides a buffer smaller than the event header size (8 bytes).

Fix by using min_t() to clamp the copy size, This ensures we never copy more than the user requested.

This vulnerability is rated as Moderate because exploitation requires local access and the presence of specialized Mark of the Unicorn (MOTU) FireWire audio hardware. In typical Red Hat Enterprise Linux environments, FireWire audio interfaces are rarely attached or utilized, substantially constraining exposure. An unprivileged local user able to interact with the ALSA hwdep device interface could induce an out-of-bounds write to a user-supplied buffer, leading to a denial of service or potential information leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.