CVE-2025-68783

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel’s ALSA subsystem contains a flaw within the usb-mixer component, specifically in the us16x08 driver. The get meter levels from urb() function processes meter packets received from devices and populates arrays (meter level[], comp level[], and master level[]) within the snd us16x08 meter store structure. Currently, the function calculates the channel index directly from the meter packet without range validation. This can lead to out-of-bounds writes to these arrays if a device sends a packet with a negative or out-of-range channel number. The issue is addressed by introducing a local channel variable and validating it before updating the arrays, rejecting negative indices and limiting array access to defined boundaries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.