CVE-2025-39757

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

State: Published
Severity: Not scored
Published: Sep 11, 2025
Updated: Jun 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	11785ef53228d23ec386f5fe4a34601536f0c891 to before 799c06ad4c9c790c265e8b6b94947213f1fb389cAffected 11785ef53228d23ec386f5fe4a34601536f0c891 to before 786571b10b1ae6d90e1242848ce78ee7e1d493c4Affected 11785ef53228d23ec386f5fe4a34601536f0c891 to before 275e37532e8ebe25e8a4069b2d9f955bfd202a46Affected 11785ef53228d23ec386f5fe4a34601536f0c891 to before 47ab3d820cb0a502bd0074f83bb3cf7ab5d79902Affected 11785ef53228d23ec386f5fe4a34601536f0c891 to before 1034719fdefd26caeec0a44a868bb5a412c2c1a5Affected 11785ef53228d23ec386f5fe4a34601536f0c891 to before ae17b3b5e753efc239421d186cd1ff06e5ac296eAffected 11785ef53228d23ec386f5fe4a34601536f0c891 to before dfdcbcde5c20df878178245d4449feada7d5b201Affected 11785ef53228d23ec386f5fe4a34601536f0c891 to before 7ef3fd250f84494fb2f7871f357808edaa1fc6ceAffected 11785ef53228d23ec386f5fe4a34601536f0c891 to before ecfd41166b72b67d3bdeb88d224ff445f6163869Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.149 through 6.1.Not affected 6.6.103 through 6.6.Not affected 6.12.43 through 6.12.Not affected 6.15.11 through 6.15.Not affected 6.16.2 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

11785ef53228d23ec386f5fe4a34601536f0c891 to before 799c06ad4c9c790c265e8b6b94947213f1fb389cAffected
11785ef53228d23ec386f5fe4a34601536f0c891 to before 786571b10b1ae6d90e1242848ce78ee7e1d493c4Affected
11785ef53228d23ec386f5fe4a34601536f0c891 to before 275e37532e8ebe25e8a4069b2d9f955bfd202a46Affected
11785ef53228d23ec386f5fe4a34601536f0c891 to before 47ab3d820cb0a502bd0074f83bb3cf7ab5d79902Affected
11785ef53228d23ec386f5fe4a34601536f0c891 to before 1034719fdefd26caeec0a44a868bb5a412c2c1a5Affected
11785ef53228d23ec386f5fe4a34601536f0c891 to before ae17b3b5e753efc239421d186cd1ff06e5ac296eAffected
11785ef53228d23ec386f5fe4a34601536f0c891 to before dfdcbcde5c20df878178245d4449feada7d5b201Affected
11785ef53228d23ec386f5fe4a34601536f0c891 to before 7ef3fd250f84494fb2f7871f357808edaa1fc6ceAffected
11785ef53228d23ec386f5fe4a34601536f0c891 to before ecfd41166b72b67d3bdeb88d224ff445f6163869Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.149 through 6.1.*Not affected
6.6.103 through 6.6.*Not affected
6.12.43 through 6.12.*Not affected
6.15.11 through 6.15.*Not affected
6.16.2 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.