PT-2025-49370 · Linux+4 · Linux Kernel+4
Published
2025-11-10
·
Updated
2026-05-07
·
CVE-2025-40269
CVSS v2.0
6.4
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel's USB-audio driver related to potential overflow of the PCM transfer buffer. The issue arises because the packet sizes used for transferring PCM stream data over USB URB packets can exceed the limits defined by the USB descriptor's wMaxPacketSize. This can lead to a buffer overflow when the calculated packet size is larger than the maximum allowed packet size. The issue was identified by syzbot. The fix introduces a sanity check during parameter setup, returning an error if the packet size exceeds the maximum allowed size.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Rocky Linux
Ubuntu