CVE-2025-68783

An out-of-bounds write flaw was found in the Linux kernel's ALSA USB mixer driver for Tascam US-16x08 audio interfaces. The get_meter_levels_from_urb() function extracts channel indices from USB packets without validating the range. A malicious or malfunctioning USB device can send packets with out-of-bounds channel indices, causing writes beyond allocated arrays.

Exploitation requires physical access to connect a malicious USB device or a malfunctioning Tascam US-16x08 interface. The out-of-bounds write occurs in kernel memory and could potentially be leveraged for privilege escalation, though this would require precise control of the malicious device's output.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.