Executive brief
A vulnerability was identified in the Linux kernel's audio subsystem specifically affecting MOTU FireWire audio interfaces. The issue occurs when the system processes digital signal processing (DSP) events, where it could write data past the end of a designated memory area if the data size is not perfectly aligned. This could lead to system instability or allow a local user to corrupt system memory, potentially impacting the reliability and security of the operating system.
Technical details
A vulnerability in the ALSA firewire-motu driver (specifically in sound/firewire/motu/motu-hwdep.c) stems from a missing bounds check within a put_user() loop used for copying DSP event data. When the user-provided buffer size is not aligned to 4 bytes, the loop could perform a write that exceeds the buffer's boundary. This is a local vulnerability requiring low privileges and no user interaction. The flaw allows for memory corruption, which can lead to a denial of service or potentially further privilege escalation. The issue has been resolved by adding an explicit bounds check before the put_user() call in the hwdep_read function.
Affected products
- Linux Linux Kernel 5.16 to 6.18.2
Timeline
- 2025-12-09: patched: Initial fix commit authored
- 2026-01-05: disclosed: CVE published
- 2026-01-11: advisory: Updated kernel stable tree references added
References
- https://git.kernel.org/stable/c/0d71b3c2ed742f1ccb3b0b7a61afb90c0251093f
- https://git.kernel.org/stable/c/298e753880b6ea99ac30df34959a7a03b0878eed
- https://git.kernel.org/stable/c/6d4f17782ce4facf3197e79707df411ee3d7b30a
- https://git.kernel.org/stable/c/8f9e51cf2a2a43d0cd72d3dc0b5ccea3f639c187
- https://git.kernel.org/stable/c/df692cf2b601a54b34edfdb9e683d67483aa8ce1
- https://git.kernel.org/stable/c/ea2c921d9de6e32ca50cb817b9d57bb881be70de