Executive brief
The Linux kernel USB-audio driver contains an out-of-bounds access vulnerability affecting Extigy and Mbox devices. A malicious USB device can provide a bNumConfigurations value that exceeds the expected allocation, leading to memory corruption during configuration destruction. This flaw can be exploited by an attacker with physical access to escalate privileges or execute arbitrary code.
Affected products
- Linux Linux Kernel 2.6.12 to 4.19.325, 4.20 to 5.4.287, 5.5 to 5.10.231, 5.11 to 5.15.174, 5.16 to 6.1.120, 6.2 to 6.6.64, 6.7 to 6.11.11, 6.12 to 6.12.2
- Debian Debian Linux 11.0
Timeline
- 2024-12-27: patched: Patch commits identified in kernel.org stable trees.
- 2025-03-01: advisory: Debian LTS announcement.
- 2025-04-09: disclosed: Publication date.
- 2025-04-09: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
- 2025-04-09: exploited: Confirmed as exploited in the wild by CISA.