PT-2025-36002 · Linux +1 · Linux Kernel +1

Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-38729

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions:

Linux kernel (affected versions not specified)

Description:

The Linux kernel contains a flaw in the ALSA subsystem related to USB audio. Specifically, UAC3 power domain descriptors require validation of their `bLength` variable to prevent out-of-bounds (OOB) access triggered by malicious firmware.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-38729

Affected Products

Debian

Linux Kernel

References · 15

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38729 · Security Note
• https://security-tracker.debian.org/tracker/source-package/linux · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-38729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38729 · Security Note
• https://twitter.com/CVEnew/status/1963637899519500332 · Twitter Post
• https://git.kernel.org/stable/c/452ad54f432675982cc0d6eb6c40a6c86ac61dbd · Note
• https://git.kernel.org/stable/c/07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dc · Note
• https://packages.debian.org/src:linux · Note
• https://git.kernel.org/stable/c/cd08d390d15b204cac1d3174f5f149a20c52e61a · Note
• https://git.kernel.org/stable/c/1666207ba0a5973735ef010812536adde6174e81 · Note
• https://git.kernel.org/stable/c/ebc9e06b6ea978a20abf9b87d41afc51b2d745ac · Note
• https://git.kernel.org/stable/c/f03418bb9d542f44df78eec2eff4ac83c0a8ac0d · Note
• https://git.kernel.org/stable/c/40714daf4d0448e1692c78563faf0ed0f9d9b5c7 · Note
• https://git.kernel.org/stable/c/d832ccbc301fbd9e5a1d691bdcf461cdb514595f · Note
• https://git.kernel.org/stable/c/29b415ec09f5b9d1dfa2423b826725a8c8796b9a · Note