CVE-2025-68753

ALSA: firewire-motu: add bounds check in put_user loop for DSP events

State: Published
Severity: 7.1 High
Published: Jan 5, 2026
Updated: Oct 19, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire-motu: add bounds check in put_user loop for DSP events

In the DSP event handling code, a put_user() loop copies event data. When the user buffer size is not aligned to 4 bytes, it could overwrite beyond the buffer boundary.

Fix by adding a bounds check before put_user().

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
LinuxLinux	634ec0b2906efd46f6f57977e172aa3470aca432 to before ea2c921d9de6e32ca50cb817b9d57bb881be70deAffected 634ec0b2906efd46f6f57977e172aa3470aca432 to before 6d4f17782ce4facf3197e79707df411ee3d7b30aAffected 634ec0b2906efd46f6f57977e172aa3470aca432 to before 0d71b3c2ed742f1ccb3b0b7a61afb90c0251093fAffected 634ec0b2906efd46f6f57977e172aa3470aca432 to before df692cf2b601a54b34edfdb9e683d67483aa8ce1Affected 634ec0b2906efd46f6f57977e172aa3470aca432 to before 8f9e51cf2a2a43d0cd72d3dc0b5ccea3f639c187Affected 634ec0b2906efd46f6f57977e172aa3470aca432 to before 298e753880b6ea99ac30df34959a7a03b0878eedAffected
LinuxLinux	5.16Affected before 5.16Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.63 through 6.12.Not affected 6.17.13 through 6.17.Not affected 6.18.2 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

634ec0b2906efd46f6f57977e172aa3470aca432 to before ea2c921d9de6e32ca50cb817b9d57bb881be70deAffected
634ec0b2906efd46f6f57977e172aa3470aca432 to before 6d4f17782ce4facf3197e79707df411ee3d7b30aAffected
634ec0b2906efd46f6f57977e172aa3470aca432 to before 0d71b3c2ed742f1ccb3b0b7a61afb90c0251093fAffected
634ec0b2906efd46f6f57977e172aa3470aca432 to before df692cf2b601a54b34edfdb9e683d67483aa8ce1Affected
634ec0b2906efd46f6f57977e172aa3470aca432 to before 8f9e51cf2a2a43d0cd72d3dc0b5ccea3f639c187Affected
634ec0b2906efd46f6f57977e172aa3470aca432 to before 298e753880b6ea99ac30df34959a7a03b0878eedAffected

LinuxLinux

5.16Affected
before 5.16Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.63 through 6.12.*Not affected
6.17.13 through 6.17.*Not affected
6.18.2 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.