CVE-2025-40275

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-40275
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40275.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-40275
Downstream
Related
Published
2025-12-06T21:50:57.914Z
Modified
2026-03-31T17:29:46.761323550Z
Summary
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
Details

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix NULL pointer dereference in sndusbmixercontrolsbadd

In sndusbcreatestreams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usbifnumtoif(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, sndusbmixercontrolsbadd() assumes that the IAD retrieved from usbifnumtoif() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usbifnumtoif() fails to find the interface descriptor.

This patch adds a NULL pointer check after calling usbifnumtoif() in sndusbmixercontrols_badd() to prevent the dereference.

This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40275.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
17156f23e93c0f59e06dd2aaffd06221341caaee
Fixed
23aea9c74aeea2625aaf4fbcc6beb9d09e30f9e4
Fixed
c5c08965ab96b16361e69a1e2a0e89dbcb99b5a6
Fixed
9f282104627be5fbded3102ff9004f753c55a063
Fixed
2762d3ea9c929ca4094541ca517c317ffa94625b
Fixed
57f607c112966c21240c424b33e2cb71e121dcf0
Fixed
cbdbfc756f2990942138ed0138da9303b4dbf9ff
Fixed
85568535893600024d7d8794f4f8b6428b521e0c
Fixed
632108ec072ad64c8c83db6e16a7efee29ebfb74

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40275.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.18.0
Fixed
5.4.302
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.247
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.197
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.159
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.117
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.59
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.17.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40275.json"