CVE-2025-40275

Vulnerability

Description

In the Linux kernel, the ALSA USB audio driver's snd_usb_mixer_controls_badd() function assumes that usb_ifnum_to_if() always returns a valid pointer. For UAC3 devices, when the Interface Association Descriptor (IAD) retrieval fails via snd_usb_create_streams(), a fallback routine sets a BADD profile. However, snd_usb_mixer_controls_badd() does not check if usb_ifnum_to_if() returns NULL, leading to a NULL pointer dereference [1].

Exploitation

Prerequisites

The vulnerability can be triggered by a physically present or hot-plugged malicious USB device that provides a crafted USB device descriptor. No authentication or special privileges are required; an attacker only needs the ability to connect a USB device to the target system [1].

Impact

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (denial of service). The vulnerability does not appear to allow arbitrary code execution; it is limited to causing a kernel oops [1].

Mitigation

The issue was discovered by syzkaller and is fixed in the Linux kernel stable updates. Users should apply the latest kernel patches to prevent exploitation. The fix adds a NULL check after usb_ifnum_to_if() in snd_usb_mixer_controls_badd() [1].