NULL Pointer Dereference in Linux Kernel's ALSA usb-audio Component

CVE-2025-40275

What is CVE-2025-40275?

A vulnerability in the Linux kernel's ALSA usb-audio component can lead to a NULL pointer dereference when handling USB audio streams for UAC version 3 devices. Specifically, in the function snd_usb_mixer_controls_badd(), an improper assumption is made regarding the validity of an Interface Association Descriptor (IAD) retrieved via usb_ifnum_to_if(). If this call fails, the fallback routine erroneously assumes the descriptor is valid, resulting in potential system instability. This issue can be exploited by sending a crafted USB device descriptor. A patch has been implemented to add a NULL pointer check to prevent such dereference issues.

References