Home

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor. This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference. This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.

PUBLISHED Reserved 2025-04-16 | Published 2025-12-06 | Updated 2025-12-06 | Assigner Linux

Product status

Default status
unaffected

17156f23e93c0f59e06dd2aaffd06221341caaee (git) before 23aea9c74aeea2625aaf4fbcc6beb9d09e30f9e4
affected

17156f23e93c0f59e06dd2aaffd06221341caaee (git) before c5c08965ab96b16361e69a1e2a0e89dbcb99b5a6
affected

17156f23e93c0f59e06dd2aaffd06221341caaee (git) before 9f282104627be5fbded3102ff9004f753c55a063
affected

17156f23e93c0f59e06dd2aaffd06221341caaee (git) before 2762d3ea9c929ca4094541ca517c317ffa94625b
affected

17156f23e93c0f59e06dd2aaffd06221341caaee (git) before 57f607c112966c21240c424b33e2cb71e121dcf0
affected

17156f23e93c0f59e06dd2aaffd06221341caaee (git) before cbdbfc756f2990942138ed0138da9303b4dbf9ff
affected

17156f23e93c0f59e06dd2aaffd06221341caaee (git) before 85568535893600024d7d8794f4f8b6428b521e0c
affected

17156f23e93c0f59e06dd2aaffd06221341caaee (git) before 632108ec072ad64c8c83db6e16a7efee29ebfb74
affected

Default status
affected

4.18
affected

Any version before 4.18
unaffected

5.4.302 (semver)
unaffected

5.10.247 (semver)
unaffected

5.15.197 (semver)
unaffected

6.1.159 (semver)
unaffected

6.6.117 (semver)
unaffected

6.12.59 (semver)
unaffected

6.17.9 (semver)
unaffected

6.18 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/23aea9c74aeea2625aaf4fbcc6beb9d09e30f9e4

git.kernel.org/...c/c5c08965ab96b16361e69a1e2a0e89dbcb99b5a6

git.kernel.org/...c/9f282104627be5fbded3102ff9004f753c55a063

git.kernel.org/...c/2762d3ea9c929ca4094541ca517c317ffa94625b

git.kernel.org/...c/57f607c112966c21240c424b33e2cb71e121dcf0

git.kernel.org/...c/cbdbfc756f2990942138ed0138da9303b4dbf9ff

git.kernel.org/...c/85568535893600024d7d8794f4f8b6428b521e0c

git.kernel.org/...c/632108ec072ad64c8c83db6e16a7efee29ebfb74

cve.org (CVE-2025-40275)

nvd.nist.gov (CVE-2025-40275)

Download JSON