PT-2026-2515 · Linux+2 · Linux Kernel+2
Published
2025-12-17
·
Updated
2026-05-11
·
CVE-2025-68783
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel’s ALSA subsystem contains a flaw within the
usb-mixer component, specifically in the us16x08 driver. The get meter levels from urb() function processes meter packets received from devices and populates arrays (meter level[], comp level[], and master level[]) within the snd us16x08 meter store structure. Currently, the function calculates the channel index directly from the meter packet without range validation. This can lead to out-of-bounds writes to these arrays if a device sends a packet with a negative or out-of-range channel number. The issue is addressed by introducing a local channel variable and validating it before updating the arrays, rejecting negative indices and limiting array access to defined boundaries.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu