Executive brief
A vulnerability was identified in the Linux kernel's audio subsystem specifically affecting MOTU FireWire audio interfaces. The issue occurs when the system handles digital signal processing (DSP) events, potentially allowing a local user to cause a buffer overflow. This could lead to a system crash or unauthorized access to sensitive system memory, impacting the overall stability and security of the operating system.
Technical details
A buffer overflow exists in the sound/firewire/motu/motu-hwdep.c component of the Linux kernel. The vulnerability is located in the hwdep_read() function, which handles DSP events. When a user-space process provides a buffer smaller than the expected event header size (8 bytes), the code fails to properly validate the buffer length before performing a copy operation. An attacker with local access can exploit this by providing a small buffer, causing the kernel to write beyond the bounds of the user-supplied memory. This can lead to local privilege escalation or a kernel panic. The issue has been resolved by implementing proper bounds checking using the min_t() macro to clamp the copy size to the user-requested length.
Affected products
- Linux Linux Kernel 5.16 to 6.18.2
Timeline
- 2025-12-03: disclosed: Vulnerability reported by researchers
- 2025-12-05: patched: Initial fix committed to the Linux kernel tree
- 2025-12-24: advisory: CVE-2025-68347 published
References
- https://git.kernel.org/stable/c/161291bac551821bba98eb4ea84c82338578d1b0
- https://git.kernel.org/stable/c/16620f0617400746984362c3d6ac547eeae1d35f
- https://git.kernel.org/stable/c/210d77cca3d0494ed30a5c628b20c1d95fa04fb1
- https://git.kernel.org/stable/c/6275fd726d53a8ec724f20201cf3bd862711e17b
- https://git.kernel.org/stable/c/cdda0d06f8650e33255f79839f188bbece44117c
- https://git.kernel.org/stable/c/ddd32ec66bc4eb6969fe835e4cc1c0706c6348fe