ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() In snd_usb_get_audioformat_uac3(), the length value returned from snd_usb_ctl_msg() is used directly for memory allocation without validation. This length is controlled by the USB device. The allocated buffer is cast to a uac3_cluster_header_descriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read. Add a length check to ensure the buffer is large enough for uac3_cluster_header_descriptor.

Timeline

1. Jul 9, 2025, 10:42 AM UTCCVE published
2. May 11, 2026, 9:24 PM UTCRecord last updated

Affected versions

• Linux Linux

  Version range not reported

• Linux Linux

  4.17

References 8