CVE-2025-40275

ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd

State: Published
Severity: Not scored
Published: Dec 6, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd

In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor.

This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference.

This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	17156f23e93c0f59e06dd2aaffd06221341caaee to before 23aea9c74aeea2625aaf4fbcc6beb9d09e30f9e4Affected 17156f23e93c0f59e06dd2aaffd06221341caaee to before c5c08965ab96b16361e69a1e2a0e89dbcb99b5a6Affected 17156f23e93c0f59e06dd2aaffd06221341caaee to before 9f282104627be5fbded3102ff9004f753c55a063Affected 17156f23e93c0f59e06dd2aaffd06221341caaee to before 2762d3ea9c929ca4094541ca517c317ffa94625bAffected 17156f23e93c0f59e06dd2aaffd06221341caaee to before 57f607c112966c21240c424b33e2cb71e121dcf0Affected 17156f23e93c0f59e06dd2aaffd06221341caaee to before cbdbfc756f2990942138ed0138da9303b4dbf9ffAffected 17156f23e93c0f59e06dd2aaffd06221341caaee to before 85568535893600024d7d8794f4f8b6428b521e0cAffected 17156f23e93c0f59e06dd2aaffd06221341caaee to before 632108ec072ad64c8c83db6e16a7efee29ebfb74Affected
LinuxLinux	4.18Affected before 4.18Not affected 5.4.302 through 5.4.Not affected 5.10.247 through 5.10.Not affected 5.15.197 through 5.15.Not affected 6.1.159 through 6.1.Not affected 6.6.117 through 6.6.Not affected 6.12.59 through 6.12.Not affected 6.17.9 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

17156f23e93c0f59e06dd2aaffd06221341caaee to before 23aea9c74aeea2625aaf4fbcc6beb9d09e30f9e4Affected
17156f23e93c0f59e06dd2aaffd06221341caaee to before c5c08965ab96b16361e69a1e2a0e89dbcb99b5a6Affected
17156f23e93c0f59e06dd2aaffd06221341caaee to before 9f282104627be5fbded3102ff9004f753c55a063Affected
17156f23e93c0f59e06dd2aaffd06221341caaee to before 2762d3ea9c929ca4094541ca517c317ffa94625bAffected
17156f23e93c0f59e06dd2aaffd06221341caaee to before 57f607c112966c21240c424b33e2cb71e121dcf0Affected
17156f23e93c0f59e06dd2aaffd06221341caaee to before cbdbfc756f2990942138ed0138da9303b4dbf9ffAffected
17156f23e93c0f59e06dd2aaffd06221341caaee to before 85568535893600024d7d8794f4f8b6428b521e0cAffected
17156f23e93c0f59e06dd2aaffd06221341caaee to before 632108ec072ad64c8c83db6e16a7efee29ebfb74Affected

LinuxLinux

4.18Affected
before 4.18Not affected
5.4.302 through 5.4.*Not affected
5.10.247 through 5.10.*Not affected
5.15.197 through 5.15.*Not affected
6.1.159 through 6.1.*Not affected
6.6.117 through 6.6.*Not affected
6.12.59 through 6.12.*Not affected
6.17.9 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.