CVE-2025-68753

A buffer overwrite vulnerability was found in the Linux kernel's ALSA firewire-motu driver. When handling DSP events, the put_user() loop copies event data to userspace without properly checking if the user buffer size is aligned to 4 bytes. If the buffer is misaligned, the copy operation can write beyond the intended buffer boundary.

This vulnerability requires local access and the presence of FireWire MOTU audio hardware. The overwrite occurs in userspace memory provided by the calling application, limiting the security impact. Standard Red Hat Enterprise Linux configurations do not typically include FireWire audio hardware support.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the snd_firewire_motu module from being loaded if MOTU FireWire audio devices are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.