{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"24ff7d465c4284529bbfa207757bffb6f44b6403","status":"affected","version":"9a2fe9b801f585baccf8352d82839dcd54b300cf","versionType":"git"},{"lessThan":"2dc1c3edf67abd30c757f8054a5da61927cdda21","status":"affected","version":"9a2fe9b801f585baccf8352d82839dcd54b300cf","versionType":"git"},{"lessThan":"c3fb926abe90d86f5e3055e0035f04d9892a118b","status":"affected","version":"9a2fe9b801f585baccf8352d82839dcd54b300cf","versionType":"git"},{"lessThan":"6eb211788e1370af52a245d4d7da35c374c7b401","status":"affected","version":"9a2fe9b801f585baccf8352d82839dcd54b300cf","versionType":"git"},{"lessThan":"74fcb3852a2f579151ce80b9ed96cd916ba0d5d8","status":"affected","version":"9a2fe9b801f585baccf8352d82839dcd54b300cf","versionType":"git"},{"lessThan":"0ee87c2814deb5e42921281116ac3abcb326880b","status":"affected","version":"9a2fe9b801f585baccf8352d82839dcd54b300cf","versionType":"git"},{"lessThan":"11e740dc1a2c8590eb7074b5c4ab921bb6224c36","status":"affected","version":"9a2fe9b801f585baccf8352d82839dcd54b300cf","versionType":"git"},{"lessThan":"fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a","status":"affected","version":"9a2fe9b801f585baccf8352d82839dcd54b300cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.17"},{"lessThan":"4.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.296","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.240","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.187","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.143","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.96","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.36","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38249","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()\n\nIn snd_usb_get_audioformat_uac3(), the length value returned from\nsnd_usb_ctl_msg() is used directly for memory allocation without\nvalidation. This length is controlled by the USB device.\n\nThe allocated buffer is cast to a uac3_cluster_header_descriptor\nand its fields are accessed without verifying that the buffer\nis large enough. If the device returns a smaller than expected\nlength, this leads to an out-of-bounds read.\n\nAdd a length check to ensure the buffer is large enough for\nuac3_cluster_header_descriptor.","epss":{"date":"2026-11-05","percentile":0.08259,"score":0.00186},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793912548997,"publishedAt":1752057749704,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/24ff7d465c4284529bbfa207757bffb6f44b6403"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/2dc1c3edf67abd30c757f8054a5da61927cdda21"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/c3fb926abe90d86f5e3055e0035f04d9892a118b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/6eb211788e1370af52a245d4d7da35c374c7b401"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/74fcb3852a2f579151ce80b9ed96cd916ba0d5d8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/0ee87c2814deb5e42921281116ac3abcb326880b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/11e740dc1a2c8590eb7074b5c4ab921bb6224c36"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"remediation":[],"revision":"aa1362ee1bf96620b9a1f7b3fe2dd75f2d46f9850b6c60d0a26664164975c7ae","sources":[{"modifiedAt":1793912548997,"name":"CNA: Linux","retrievedAt":1793913625902,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38249"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913634174,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38249"}],"ssvc":{"assessedAt":1793911933078,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()","updatedAt":1793913634174}