Buffer Overflow Vulnerability in Linux Kernel's USB-Audio Driver

CVE-2025-40269

What is CVE-2025-40269?

A vulnerability in the Linux kernel's USB-audio driver could lead to a buffer overflow due to inadequate checks on USB packet sizes. The size of the PCM stream data packets is dynamically determined but must conform to USB descriptor limits. If the calculated packet size exceeds the maximum permissible value, the system may enter an unstable state, presenting potential security risks. The introduced patch adds a sanity check to validate packet sizes against defined limits, ensuring that operations are halted before any harmful actions are executed. This proactive measure guards against issues stemming from aberrant USB descriptors.

References