ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provides a buffer smaller than the event header size (8 bytes). Fix by using min_t() to clamp the copy size, This ensures we never copy more than the user requested.

Timeline

1. Dec 24, 2025, 10:32 AM UTCCVE published
2. Oct 16, 2026, 3:04 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 16, 2026, 3:09 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 634ec0b2906efd46f6f57977e172aa3470aca432 · fixed in 16620f0617400746984362c3d6ac547eeae1d35f; From 634ec0b2906efd46f6f57977e172aa3470aca432 · fixed in ddd32ec66bc4eb6969fe835e4cc1c0706c6348fe; From 634ec0b2906efd46f6f57977e172aa3470aca432 · fixed in 6275fd726d53a8ec724f20201cf3bd862711e17b; From 634ec0b2906efd46f6f57977e172aa3470aca432 · fixed in 161291bac551821bba98eb4ea84c82338578d1b0; From 634ec0b2906efd46f6f57977e172aa3470aca432 · fixed in cdda0d06f8650e33255f79839f188bbece44117c; From 634ec0b2906efd46f6f57977e172aa3470aca432 · fixed in 210d77cca3d0494ed30a5c628b20c1d95fa04fb1

• Linux Linux

  5.16

• KernelLinux

  From 5.16.0 · fixed in 6.1.160; From 6.2.0 · fixed in 6.6.120; From 6.7.0 · fixed in 6.12.63; From 6.13.0 · fixed in 6.17.13; From 6.18.0 · fixed in 6.18.2

References 6