What’s Vulnerable › Vulnerabilities

CVE-2025-38729: ALSA: usb-audio: Validate UAC3 power domain descriptors, too

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-04 · updated 2026-10-19
• Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 4.17 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43 — fixed in 5.10.241, 5.15.190, 5.4.297, 6.1.149, 6.12.43, 6.15.11

How to fix

Upgrade to a fixed version: Linux kernel 5.10.241, 5.15.190, 5.4.297, 6.1.149. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dc
• https://git.kernel.org/stable/c/1666207ba0a5973735ef010812536adde6174e81
• https://git.kernel.org/stable/c/29b415ec09f5b9d1dfa2423b826725a8c8796b9a
• https://git.kernel.org/stable/c/40714daf4d0448e1692c78563faf0ed0f9d9b5c7
• https://git.kernel.org/stable/c/452ad54f432675982cc0d6eb6c40a6c86ac61dbd
• https://git.kernel.org/stable/c/cd08d390d15b204cac1d3174f5f149a20c52e61a
• https://git.kernel.org/stable/c/d832ccbc301fbd9e5a1d691bdcf461cdb514595f
• https://git.kernel.org/stable/c/ebc9e06b6ea978a20abf9b87d41afc51b2d745ac
• https://git.kernel.org/stable/c/f03418bb9d542f44df78eec2eff4ac83c0a8ac0d
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html

Get alerted when CVE-2025-38729 or the next vulnerability affects your stack