CVE-2025-68783

Vulnerability

Overview

The Linux kernel's ALSA usb-mixer driver for the TASCAM US-16x08 audio interface contains an out-of-bounds write vulnerability in the get_meter_levels_from_urb() function. This function parses 64-byte meter packets sent by the device and uses a channel index derived directly from the packet data (MUB2(meter_urb, s) - 1) to index into the meter_level[], comp_level[], and master_level[] arrays without validating the range. If the device sends a packet with a negative or out-of-range channel number, the driver writes past the end of these arrays, causing memory corruption.

Exploitation

The vulnerability is exploitable by an attacker who can control the USB device connected to the system or who can inject malicious USB packets (e.g., through a compromised or malicious USB device). No special privileges are required beyond the ability to send USB control transfers to the affected driver. The attack surface is local physical access or a compromised USB device; remote exploitation is not possible without prior USB access.

Impact

Successful exploitation allows an attacker to write controlled data beyond the bounds of the stack-allocated arrays, potentially leading to kernel memory corruption. This can result in a denial of service (system crash) or, in more sophisticated scenarios, arbitrary code execution in the kernel context. The vulnerability affects systems with the US-16x08 device connected and the snd-usb-usx2y driver loaded.

Mitigation

The fix was applied in Linux kernel commits [1], [2], and [3] (stable backports). Users should update to a kernel version containing these patches. No workaround is available other than disconnecting the affected device or blacklisting the driver. The vulnerability is not known to be exploited in the wild as of publication.