CVE-2025-39757

Vulnerability

Description

The ALSA USB-audio driver in the Linux kernel fails to validate UAC3 cluster segment descriptors. Specifically, it does not verify that the declared length of these descriptors matches the actual size nor that they fit within the allocated buffer. This flaw can be exploited by a malicious USB audio device providing crafted descriptors [1][2].

Exploitation

An attacker with physical access or the ability to connect a USB device can exploit this vulnerability by supplying a malformed UAC3 cluster segment descriptor. No authentication is required; the vulnerability is triggered upon device enumeration [1].

Impact

Successful exploitation can lead to out-of-bounds memory reads or writes, potentially causing a system crash, information disclosure, or privilege escalation in the kernel context [1][2].

Mitigation

The Linux kernel has been patched in stable releases. Users should update to the latest kernel version. Siemens advisory SSA-032379 also lists affected products (e.g., SIMATIC CN 4100) and recommends upgrading to V5.0 [1].