CVE-2025-38249

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out-of-bounds read in sndusbgetaudioformatuac3()

In sndusbgetaudioformatuac3(), the length value returned from sndusbctl_msg() is used directly for memory allocation without validation. This length is controlled by the USB device.

The allocated buffer is cast to a uac3clusterheader_descriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read.

Add a length check to ensure the buffer is large enough for uac3clusterheader_descriptor.