In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix NULL pointer dereference in sndusbmixercontrolsbadd
In sndusbcreatestreams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usbifnumtoif(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, sndusbmixercontrolsbadd() assumes that the IAD retrieved from usbifnumtoif() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usbifnumtoif() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usbifnumtoif() in sndusbmixercontrols_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40275.json"
}