Bug 2419919 (CVE-2025-40269) - CVE-2025-40269 kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service
Summary: CVE-2025-40269 kernel: Linux kernel ALSA USB audio driver: Buffer overflow le...
Keywords:
Status: NEW
Alias: CVE-2025-40269
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-08 07:08 UTC by OSIDB Bzimport
Modified: 2026-03-11 00:43 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:2212 0 None None None 2026-02-09 02:13:22 UTC
Red Hat Product Errata RHSA-2026:2264 0 None None None 2026-02-09 04:38:23 UTC
Red Hat Product Errata RHSA-2026:2378 0 None None None 2026-02-10 02:00:19 UTC
Red Hat Product Errata RHSA-2026:2721 0 None None None 2026-02-16 11:53:10 UTC
Red Hat Product Errata RHSA-2026:2759 0 None None None 2026-02-16 17:27:36 UTC
Red Hat Product Errata RHSA-2026:2761 0 None None None 2026-02-16 17:47:15 UTC
Red Hat Product Errata RHSA-2026:2766 0 None None None 2026-02-17 00:43:08 UTC
Red Hat Product Errata RHSA-2026:3267 0 None None None 2026-02-25 00:19:01 UTC
Red Hat Product Errata RHSA-2026:3293 0 None None None 2026-02-25 08:01:47 UTC
Red Hat Product Errata RHSA-2026:3358 0 None None None 2026-02-25 14:15:07 UTC
Red Hat Product Errata RHSA-2026:3375 0 None None None 2026-02-25 18:58:24 UTC
Red Hat Product Errata RHSA-2026:4242 0 None None None 2026-03-11 00:42:12 UTC
Red Hat Product Errata RHSA-2026:4243 0 None None None 2026-03-11 00:43:21 UTC

Description OSIDB Bzimport 2025-12-08 07:08:44 UTC
In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

The PCM stream data in USB-audio driver is transferred over USB URB
packet buffers, and each packet size is determined dynamically.  The
packet sizes are limited by some factors such as wMaxPacketSize USB
descriptor.  OTOH, in the current code, the actually used packet sizes
are determined only by the rate and the PPS, which may be bigger than
the size limit above.  This results in a buffer overflow, as reported
by syzbot.

Basically when the limit is smaller than the calculated packet size,
it implies that something is wrong, most likely a weird USB
descriptor.  So the best option would be just to return an error at
the parameter setup time before doing any further operations.

This patch introduces such a sanity check, and returns -EINVAL when
the packet size is greater than maxpacksize.  The comparison with
ep->packsize[1] alone should suffice since it's always equal or
greater than ep->packsize[0].

Comment 4 errata-xmlrpc 2026-02-09 02:13:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:2212 https://access.redhat.com/errata/RHSA-2026:2212

Comment 5 errata-xmlrpc 2026-02-09 04:38:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:2264 https://access.redhat.com/errata/RHSA-2026:2264

Comment 6 errata-xmlrpc 2026-02-10 02:00:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:2378 https://access.redhat.com/errata/RHSA-2026:2378

Comment 7 errata-xmlrpc 2026-02-16 11:53:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:2721 https://access.redhat.com/errata/RHSA-2026:2721

Comment 8 errata-xmlrpc 2026-02-16 17:27:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:2759 https://access.redhat.com/errata/RHSA-2026:2759

Comment 9 errata-xmlrpc 2026-02-16 17:47:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:2761 https://access.redhat.com/errata/RHSA-2026:2761

Comment 10 errata-xmlrpc 2026-02-17 00:43:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:2766 https://access.redhat.com/errata/RHSA-2026:2766

Comment 11 errata-xmlrpc 2026-02-25 00:19:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:3267 https://access.redhat.com/errata/RHSA-2026:3267

Comment 12 errata-xmlrpc 2026-02-25 08:01:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:3293 https://access.redhat.com/errata/RHSA-2026:3293

Comment 13 errata-xmlrpc 2026-02-25 14:15:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:3358 https://access.redhat.com/errata/RHSA-2026:3358

Comment 14 errata-xmlrpc 2026-02-25 18:58:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:3375 https://access.redhat.com/errata/RHSA-2026:3375

Comment 15 errata-xmlrpc 2026-03-11 00:42:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:4242 https://access.redhat.com/errata/RHSA-2026:4242

Comment 16 errata-xmlrpc 2026-03-11 00:43:20 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:4243 https://access.redhat.com/errata/RHSA-2026:4243


Note You need to log in before you can comment on or make changes to this bug.