AZL-74372
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-74372.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-74372
- Upstream
- Published
- 2026-01-13T16:15:58Z
- Modified
- 2026-04-01T05:22:22.769587Z
- Summary
- CVE-2025-68783 affecting package kernel for versions less than 6.6.121.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-mixer: us16x08: validate meter packet indices
getmeterlevelsfromurb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel[], complevel[] and masterlevel[] in struct sndus16x08meterstore.
Currently the function derives the channel index directly from the meter packet (MUB2(meter_urb, s) - 1) and uses it to index those arrays without validating the range. If the packet contains a negative or out-of-range channel number, the driver may write past the end of these arrays.
Introduce a local channel variable and validate it before updating the arrays. We reject negative indices, limit meterlevel[] and complevel[] to SNDUS16X08MAXCHANNELS, and guard masterlevel[] updates with ARRAYSIZE(masterlevel).
- References