CVE-2025-38249

The CVE CVE-2025-38249 affects the Linux kernel ALSA USB-audio path (snd_usb_get_audioformat_uac3). The root cause is that the length returned by snd_usb_ctl_msg() is used directly to allocate memory and then access the buffer as a uac3_cluster_header_descriptor without verifying the buffer size....