In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in sndusbgetaudioformatuac3() In sndusbgetaudioformatuac3(), the length value returned from sndusbctlmsg() is used directly for memory allocation without validation. This length is controlled by the USB device. The allocated buffer is cast to a uac3clusterheaderdescriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read. Add a length check to ensure the buffer is large enough for uac3clusterheader_descriptor.