CVE-2025-38729

HIGH

Linux Kernel - Out-of-bounds Write in UAC3 Power Domain Descriptor Validation

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.

References (12)

Core 12
Core References

Scores

CVSS v3 7.8
EPSS 0.0002
EPSS Percentile 6.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (31)
debian/debian_linux 11.0
linux/Kernel 4.17.0 - 5.4.297linux
linux/Kernel 5.11.0 - 5.15.190linux
linux/Kernel 5.16.0 - 6.1.149linux
linux/Kernel 5.5.0 - 5.10.241linux
linux/Kernel 6.13.0 - 6.15.11linux
linux/Kernel 6.16.0 - 6.16.2linux
linux/Kernel 6.2.0 - 6.6.103linux
linux/Kernel 6.7.0 - 6.12.43linux
Linux/Linux < 4.17
... and 21 more
Published Sep 04, 2025
Tracked Since Feb 18, 2026