CVE-2025-38249 ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Buffer Overflow Vulnerabilities in ALSA Impacting Audio Drivers Two buffer overflow vulnerabilities have been identified in ALSA audio drivers, affecting the UMP SysEx message conversion and the tuning control for the CA0132 codec. The vulnerabilities are tracked as CVE-2025-37891 and CVE-2025-39751, with the former published on May 19, 2025, and the latter on September 11, 2025. 7 sources 48