CVE-2025-68344

Vulnerability

Description

In the Linux kernel's ALSA wavefront driver, the wavefront_send_sample() function contains an integer overflow vulnerability when validating sample size. The header->size field is of type u32 but is cast to int for comparison with dev->freemem. This type conversion can lead to an integer overflow, causing the validation to be bypassed.

Exploitation

An attacker with local access to the system can exploit this vulnerability by providing a crafted sample header with a large size value. When the value is cast to int, it may become negative or overflow, allowing the size check to be circumvented. The attacker would need to be able to send audio samples to the wavefront synthesizer device, which typically requires access to the ALSA device node.

Impact

Successful exploitation could allow an attacker to bypass the memory allocation size check, potentially leading to out-of-bounds writes or reads. This could corrupt kernel memory and potentially lead to privilege escalation or denial of service.

Mitigation

The vulnerability has been patched in the Linux kernel stable releases as of December 24, 2025 [1][2][3]. Users are advised to apply the latest kernel updates to mitigate this vulnerability.