CVE-2025-38729

ALSA: usb-audio: Validate UAC3 power domain descriptors, too

State: Published
Severity: Not scored
Published: Sep 4, 2025
Updated: May 12, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Validate UAC3 power domain descriptors, too

UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9a2fe9b801f585baccf8352d82839dcd54b300cf to before 1666207ba0a5973735ef010812536adde6174e81Affected 9a2fe9b801f585baccf8352d82839dcd54b300cf to before ebc9e06b6ea978a20abf9b87d41afc51b2d745acAffected 9a2fe9b801f585baccf8352d82839dcd54b300cf to before f03418bb9d542f44df78eec2eff4ac83c0a8ac0dAffected 9a2fe9b801f585baccf8352d82839dcd54b300cf to before 40714daf4d0448e1692c78563faf0ed0f9d9b5c7Affected 9a2fe9b801f585baccf8352d82839dcd54b300cf to before 07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dcAffected 9a2fe9b801f585baccf8352d82839dcd54b300cf to before cd08d390d15b204cac1d3174f5f149a20c52e61aAffected 9a2fe9b801f585baccf8352d82839dcd54b300cf to before 29b415ec09f5b9d1dfa2423b826725a8c8796b9aAffected 9a2fe9b801f585baccf8352d82839dcd54b300cf to before 452ad54f432675982cc0d6eb6c40a6c86ac61dbdAffected 9a2fe9b801f585baccf8352d82839dcd54b300cf to before d832ccbc301fbd9e5a1d691bdcf461cdb514595fAffected
LinuxLinux	4.17Affected before 4.17Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.149 through 6.1.Not affected 6.6.103 through 6.6.Not affected 6.12.43 through 6.12.Not affected 6.15.11 through 6.15.Not affected 6.16.2 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

9a2fe9b801f585baccf8352d82839dcd54b300cf to before 1666207ba0a5973735ef010812536adde6174e81Affected
9a2fe9b801f585baccf8352d82839dcd54b300cf to before ebc9e06b6ea978a20abf9b87d41afc51b2d745acAffected
9a2fe9b801f585baccf8352d82839dcd54b300cf to before f03418bb9d542f44df78eec2eff4ac83c0a8ac0dAffected
9a2fe9b801f585baccf8352d82839dcd54b300cf to before 40714daf4d0448e1692c78563faf0ed0f9d9b5c7Affected
9a2fe9b801f585baccf8352d82839dcd54b300cf to before 07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dcAffected
9a2fe9b801f585baccf8352d82839dcd54b300cf to before cd08d390d15b204cac1d3174f5f149a20c52e61aAffected
9a2fe9b801f585baccf8352d82839dcd54b300cf to before 29b415ec09f5b9d1dfa2423b826725a8c8796b9aAffected
9a2fe9b801f585baccf8352d82839dcd54b300cf to before 452ad54f432675982cc0d6eb6c40a6c86ac61dbdAffected
9a2fe9b801f585baccf8352d82839dcd54b300cf to before d832ccbc301fbd9e5a1d691bdcf461cdb514595fAffected

LinuxLinux

4.17Affected
before 4.17Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.149 through 6.1.*Not affected
6.6.103 through 6.6.*Not affected
6.12.43 through 6.12.*Not affected
6.15.11 through 6.15.*Not affected
6.16.2 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.