CVE-2025-38249

Name of the Vulnerable Software and Affected Versions: Linux Kernel (affected versions not specified)

Description: The Linux kernel contains a flaw in the snd usb get audioformat uac3() function within the ALSA subsystem. The function directly uses a length value received from a USB device for memory allocation without proper validation. This length is then used to cast a buffer to a uac3 cluster header descriptor and access its fields, potentially leading to an out-of-bounds read if the device returns a length smaller than expected.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.