LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68783: ALSA: usb-mixer: us16x08: validate meter packet indices

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_level[] and master_level[] in struct snd_us16x08_meter_store. Currently the function derives the channel index directly from the meter packet (MUB2(meter_urb, s) - 1) and uses it to index those arrays without validating the range. If the packet contains a negative or out-of-range channel number, the driver may write past the end of these arrays. Introduce a local channel variable and validate it before updating the arrays. We reject negative indices, limit meter_level[] and comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] updates with ARRAY_SIZE(master_level).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-68783 is a Linux kernel flaw in an ALSA USB mixer driver. A malformed meter packet from the device can cause the driver to write outside expected arrays. Business exposure appears narrow, mainly Linux systems using this specific USB audio path, but kernel memory corruption warrants timely patch tracking.

Executive priority

Treat as a targeted kernel hardening issue, not a broad internet-facing emergency. Patch during the next appropriate Linux maintenance window, faster for endpoints or production audio systems that accept USB devices.

Technical view

The vulnerable get_meter_levels_from_urb() function derived a channel index from a 64-byte meter packet and used it without range validation for meter_level[], comp_level[], and master_level[]. The fix validates negative and out-of-range indices and bounds master_level[] updates with ARRAY_SIZE().

Likely exposure

Likely exposure is limited to Linux hosts running affected kernel builds with the ALSA usb-mixer us16x08 driver in use and relevant USB audio hardware attached or passed through. General servers without this driver path or USB audio exposure are less likely to be affected.

Exploitation context

The source bundle does not report active exploitation, public weaponization, or KEV listing. The practical trigger appears to require malformed meter packets from the USB device path. No CVSS score, CWE, or complete impact statement is provided.

Researcher notes

Evidence supports an out-of-bounds write caused by unchecked channel indices in ALSA usb-mixer us16x08 meter parsing. The bundle does not establish exploit reliability, privilege impact, affected distributions, or crash-versus-code-execution outcomes.

Mitigation direction

  • Update to a vendor kernel package containing the ALSA us16x08 bounds-check fix.
  • Check Linux distribution advisories for exact fixed package versions and backport status.
  • Avoid attaching or passing through untrusted affected USB audio hardware until patched.
  • Prioritize workstations, audio systems, and virtual hosts with USB passthrough exposure.

Validation and detection

  • Inventory Linux hosts with affected kernel versions and USB audio use cases.
  • Check whether the snd-usb-audio/us16x08 driver path is loaded or available.
  • Confirm installed kernel includes one of the referenced stable fixes or vendor backport.
  • Review endpoint and virtualization policies for USB device passthrough exposure.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68783 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd2bb390a2081a36ffe906724d2848d846f2aeb29, d2bb390a2081a36ffe906724d2848d846f2aeb29, d2bb390a2081a36ffe906724d2848d846f2aeb29, d2bb390a2081a36ffe906724d2848d846f2aeb29, d2bb390a2081a36ffe906724d2848d846f2aeb29, d2bb390a2081a36ffe906724d2848d846f2aeb29, d2bb390a2081a36ffe906724d2848d846f2aeb29unaffected
LinuxLinux4.11, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.