CVE-2025-68783

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68783
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68783.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-68783
Downstream
Related
Published
2026-01-13T15:28:57.609Z
Modified
2026-03-12T02:16:20.898258Z
Summary
ALSA: usb-mixer: us16x08: validate meter packet indices
Details

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-mixer: us16x08: validate meter packet indices

getmeterlevelsfromurb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel[], complevel[] and masterlevel[] in struct sndus16x08meterstore.

Currently the function derives the channel index directly from the meter packet (MUB2(meter_urb, s) - 1) and uses it to index those arrays without validating the range. If the packet contains a negative or out-of-range channel number, the driver may write past the end of these arrays.

Introduce a local channel variable and validate it before updating the arrays. We reject negative indices, limit meterlevel[] and complevel[] to SNDUS16X08MAXCHANNELS, and guard masterlevel[] updates with ARRAYSIZE(masterlevel).

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68783.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d2bb390a2081a36ffe906724d2848d846f2aeb29
Fixed
53461710a95e15ac1f6542450943a492ecf8e550
Fixed
2168866396bd28ec4f3c8da0fbc7d08b5bd4f053
Fixed
cde47f4ccad6751ac36b7471572ddf38ee91870c
Fixed
2f21a7cbaaa93926f5be15bc095b9c57c35748d9
Fixed
a8ad320efb663be30b794e3dd3e829301c0d0ed3
Fixed
eaa95228b8a56c4880a182c0350d67922b22408f
Fixed
5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68783.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.11.0
Fixed
5.10.248
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.198
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.160
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.120
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.64
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68783.json"