CVE-2025-68344

ALSA: wavefront: Fix integer overflow in sample size validation

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 11, 2026
Reserved: Dec 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: wavefront: Fix integer overflow in sample size validation

The wavefront_send_sample() function has an integer overflow issue when validating sample size. The header->size field is u32 but gets cast to int for comparison with dev->freemem

Fix by using unsigned comparison to avoid integer overflow.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 488bf86d60077f52810c60dbdf7468c277880167Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d2f5d8cf1eadb7b33e476f59aa9c6653e4f2b937Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4f811071e702fbb74933526e2fbadf8c4ed0c0c4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 02b63f3bc29265bd9e83191792d200ed563acacfAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5588b7c86effffa9bb55383a38800649d7b40778Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bca11de0a277b8baeb7d006f93b543c907b6e782Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1823e08f76c68b9e1d26f6d5ef831b96f61a62a0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0c4a13ba88594fd4a27292853e736c6b4349823dAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.63 through 6.12.Not affected 6.17.13 through 6.17.Not affected 6.18.2 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 488bf86d60077f52810c60dbdf7468c277880167Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d2f5d8cf1eadb7b33e476f59aa9c6653e4f2b937Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4f811071e702fbb74933526e2fbadf8c4ed0c0c4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 02b63f3bc29265bd9e83191792d200ed563acacfAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5588b7c86effffa9bb55383a38800649d7b40778Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bca11de0a277b8baeb7d006f93b543c907b6e782Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1823e08f76c68b9e1d26f6d5ef831b96f61a62a0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0c4a13ba88594fd4a27292853e736c6b4349823dAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.63 through 6.12.*Not affected
6.17.13 through 6.17.*Not affected
6.18.2 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.