CVE-2025-40269

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

The PCM stream data in USB-audio driver is transferred over USB URB

packet buffers, and each packet size is determined dynamically. The

packet sizes are limited by some factors such as wMaxPacketSize USB

descriptor. OTOH, in the current code, the actually used packet sizes

are determined only by the rate and the PPS, which may be bigger than

the size limit above. This results in a buffer overflow, as reported

by syzbot.

Basically when the limit is smaller than the calculated packet size,

it implies that something is wrong, most likely a weird USB

descriptor. So the best option would be just to return an error at

the parameter setup time before doing any further operations.

This patch introduces such a sanity check, and returns -EINVAL when

the packet size is greater than maxpacksize. The comparison with

ep->packsize[1] alone should suffice since it

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References