← back
CVE-2025-38729

ALSA: usb-audio: Validate UAC3 power domain descriptors, too

EPSS 0.2%
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
04 Sep 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.
Affected products
Linux · Linux
References
https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlhttps://git.kernel.org/stable/c/07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dchttps://git.kernel.org/stable/c/1666207ba0a5973735ef010812536adde6174e81https://git.kernel.org/stable/c/29b415ec09f5b9d1dfa2423b826725a8c8796b9ahttps://git.kernel.org/stable/c/40714daf4d0448e1692c78563faf0ed0f9d9b5c7https://git.kernel.org/stable/c/452ad54f432675982cc0d6eb6c40a6c86ac61dbdhttps://git.kernel.org/stable/c/cd08d390d15b204cac1d3174f5f149a20c52e61ahttps://git.kernel.org/stable/c/d832ccbc301fbd9e5a1d691bdcf461cdb514595fhttps://git.kernel.org/stable/c/ebc9e06b6ea978a20abf9b87d41afc51b2d745achttps://git.kernel.org/stable/c/f03418bb9d542f44df78eec2eff4ac83c0a8ac0dhttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlhttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html