In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.
[
{
"id": "CVE-2025-39757-0dc698d1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfdcbcde5c20df878178245d4449feada7d5b201",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-25932bb2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ab3d820cb0a502bd0074f83bb3cf7ab5d79902",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-2d633a4c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae17b3b5e753efc239421d186cd1ff06e5ac296e",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-4c610aa7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecfd41166b72b67d3bdeb88d224ff445f6163869",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-61ba59c4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@799c06ad4c9c790c265e8b6b94947213f1fb389c",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-668a5ad1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@786571b10b1ae6d90e1242848ce78ee7e1d493c4",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-6bec4d5c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfdcbcde5c20df878178245d4449feada7d5b201",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-6db18820",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@786571b10b1ae6d90e1242848ce78ee7e1d493c4",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-703c0c1f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ab3d820cb0a502bd0074f83bb3cf7ab5d79902",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-7619fff0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ab3d820cb0a502bd0074f83bb3cf7ab5d79902",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "54116903185092795579038077385431084704",
"length": 4575.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-8c26ff30",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@275e37532e8ebe25e8a4069b2d9f955bfd202a46",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "54116903185092795579038077385431084704",
"length": 4575.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-9a028963",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@799c06ad4c9c790c265e8b6b94947213f1fb389c",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "54116903185092795579038077385431084704",
"length": 4575.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-a3e92a00",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1034719fdefd26caeec0a44a868bb5a412c2c1a5",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-a4cfb965",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae17b3b5e753efc239421d186cd1ff06e5ac296e",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "322251328679187409526887257862817442726",
"length": 4601.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-ac3cc660",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ef3fd250f84494fb2f7871f357808edaa1fc6ce",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "322251328679187409526887257862817442726",
"length": 4601.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-b8296f6f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@275e37532e8ebe25e8a4069b2d9f955bfd202a46",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-c0825c46",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae17b3b5e753efc239421d186cd1ff06e5ac296e",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-c09480b1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1034719fdefd26caeec0a44a868bb5a412c2c1a5",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-c4cc5f04",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@786571b10b1ae6d90e1242848ce78ee7e1d493c4",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "54116903185092795579038077385431084704",
"length": 4575.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-c6946bc4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfdcbcde5c20df878178245d4449feada7d5b201",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "322251328679187409526887257862817442726",
"length": 4601.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-c8f88120",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ef3fd250f84494fb2f7871f357808edaa1fc6ce",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "convert_chmap_v3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "1791502947850113743207468998840649972",
"length": 2759.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-cb3db8bc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@275e37532e8ebe25e8a4069b2d9f955bfd202a46",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-cf164da8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ef3fd250f84494fb2f7871f357808edaa1fc6ce",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-e3073011",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@799c06ad4c9c790c265e8b6b94947213f1fb389c",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-eb79d8f3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecfd41166b72b67d3bdeb88d224ff445f6163869",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/usb/stream.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112991124636824093553596969690974315865",
"29566494485606981861662617340903997712",
"275014534718241296736037423429910074518",
"203522926293172057971320788075162801743",
"273049758115180585063121753251181419336",
"291847554430819919343349388146127689013",
"240988095171808489691152539342300434549",
"45329305123586750671542169269356946716",
"6352257744842568376715288365513967794",
"161497797103602210793154131830777145813",
"166010706171314142681556722410593754297",
"142156330649652006897554985061219460099",
"93154087321635653765897564251944794283",
"61576772570579946305381531821115525449",
"195275144874213708784002303816669172070",
"24588398910712465662923775856203671792",
"338487620942427934316087706261910394494",
"73662096805230810399352233301478182707",
"268384692125315435308810575547110932488",
"263852651633593396986173122700346012218",
"117441971781296307285487388995380294824",
"226607497162750972957222401605416258342",
"193024201704302649158215070328698752223",
"44349192606008429455580675684484757461"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2025-39757-efb2647c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecfd41166b72b67d3bdeb88d224ff445f6163869",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "322251328679187409526887257862817442726",
"length": 4601.0
},
"signature_type": "Function"
},
{
"id": "CVE-2025-39757-ffafe355",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1034719fdefd26caeec0a44a868bb5a412c2c1a5",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "snd_usb_get_audioformat_uac3",
"file": "sound/usb/stream.c"
},
"digest": {
"function_hash": "54116903185092795579038077385431084704",
"length": 4575.0
},
"signature_type": "Function"
}
]