Junglewise Threat Intelligence

CVE-2025-40269: Linux Kernel ALSA usb-audio buffer overflow in PCM transfer buffer

CVE-2025-40269 · Severity: high · CVSS 7.8 · Published 2025-12-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's USB audio driver that could allow a malicious or malfunctioning USB device to cause a system crash or potentially execute unauthorized code. The issue occurs when the driver fails to properly validate the size of data packets received from a USB audio device, leading to a memory buffer overflow. This could be exploited by an attacker with physical access to plug in a specially crafted USB device or by a local user with the ability to redirect USB traffic. Linux has released patches across various stable versions to address this flaw.

Technical details

A buffer overflow exists in the ALSA usb-audio driver (sound/usb/endpoint.c) due to insufficient validation of PCM transfer buffer sizes. The driver dynamically calculates packet sizes based on the sampling rate and packets-per-second (PPS), but fails to verify if these calculated sizes exceed the 'wMaxPacketSize' defined in the USB descriptor. An attacker providing a malicious USB descriptor can trigger an out-of-bounds write during URB (USB Request Block) packet transfers. The vulnerability was discovered by syzbot and has been mitigated by introducing a sanity check in 'snd_usb_endpoint_set_params' that returns -EINVAL if the calculated packet size exceeds the hardware limit. Patching is available in various stable kernel branches (e.g., 6.11.y, 6.6.y, etc.).

Affected products

  • Linux Linux Kernel v2.6.11 to v6.12-rc6

Timeline

  • 2025-11-09: patched: Initial fix authored by Takashi Iwai
  • 2025-12-06: advisory: CVE-2025-40269 published

References

Related threats