Bug 2419919 (CVE-2025-40269)

Summary:	CVE-2025-40269 kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the ALSA USB audio driver of the Linux kernel. This vulnerability, a buffer overflow, occurs when the size of the Pulse-Code Modulation (PCM) stream data packets exceeds the maximum allowed by the USB descriptor. A local attacker could exploit this by providing specially crafted USB audio device parameters, causing the PCM transfer buffer to overflow. This could lead to sensitive information disclosure and potentially result in a denial of service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-12-08 07:08:44 UTC

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

The PCM stream data in USB-audio driver is transferred over USB URB
packet buffers, and each packet size is determined dynamically.  The
packet sizes are limited by some factors such as wMaxPacketSize USB
descriptor.  OTOH, in the current code, the actually used packet sizes
are determined only by the rate and the PPS, which may be bigger than
the size limit above.  This results in a buffer overflow, as reported
by syzbot.

Basically when the limit is smaller than the calculated packet size,
it implies that something is wrong, most likely a weird USB
descriptor.  So the best option would be just to return an error at
the parameter setup time before doing any further operations.

This patch introduces such a sanity check, and returns -EINVAL when
the packet size is greater than maxpacksize.  The comparison with
ep->packsize[1] alone should suffice since it's always equal or
greater than ep->packsize[0].

Comment 1 Jon Moroney 2025-12-08 19:47:41 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025120716-CVE-2025-40269-9769@gregkh/T

Comment 4 errata-xmlrpc 2026-02-09 02:13:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:2212 https://access.redhat.com/errata/RHSA-2026:2212

Comment 5 errata-xmlrpc 2026-02-09 04:38:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:2264 https://access.redhat.com/errata/RHSA-2026:2264

Comment 6 errata-xmlrpc 2026-02-10 02:00:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:2378 https://access.redhat.com/errata/RHSA-2026:2378

Comment 7 errata-xmlrpc 2026-02-16 11:53:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:2721 https://access.redhat.com/errata/RHSA-2026:2721

Comment 8 errata-xmlrpc 2026-02-16 17:27:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:2759 https://access.redhat.com/errata/RHSA-2026:2759

Comment 9 errata-xmlrpc 2026-02-16 17:47:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:2761 https://access.redhat.com/errata/RHSA-2026:2761

Comment 10 errata-xmlrpc 2026-02-17 00:43:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:2766 https://access.redhat.com/errata/RHSA-2026:2766

Comment 11 errata-xmlrpc 2026-02-25 00:19:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:3267 https://access.redhat.com/errata/RHSA-2026:3267

Comment 12 errata-xmlrpc 2026-02-25 08:01:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:3293 https://access.redhat.com/errata/RHSA-2026:3293

Comment 13 errata-xmlrpc 2026-02-25 14:15:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:3358 https://access.redhat.com/errata/RHSA-2026:3358

Comment 14 errata-xmlrpc 2026-02-25 18:58:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:3375 https://access.redhat.com/errata/RHSA-2026:3375

Comment 15 errata-xmlrpc 2026-03-11 00:42:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:4242 https://access.redhat.com/errata/RHSA-2026:4242

Comment 16 errata-xmlrpc 2026-03-11 00:43:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:4243 https://access.redhat.com/errata/RHSA-2026:4243

Comment 17 errata-xmlrpc 2026-03-25 14:42:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:5821 https://access.redhat.com/errata/RHSA-2026:5821