CVE-2025-68346
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: dice: fix buffer overflow in detect_stream_formats() The function detect_stream_formats() reads the stream_count value directly from a FireWire device without validating it. This can lead to out-of-bounds writes when a malicious device provides a stream_count value greater than MAX_STREAMS. Fix by applying the same validation to both TX and RX stream counts in detect_stream_formats().
Severity
Not scored
CVSS score
Not available
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-12-24 11:15:57.947000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-68346",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-12-24T11:15:57.947",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: dice: fix buffer overflow in detect_stream_formats()\n\nThe function detect_stream_formats() reads the stream_count value directly\nfrom a FireWire device without validating it. This can lead to\nout-of-bounds writes when a malicious device provides a stream_count value\ngreater than MAX_STREAMS.\n\nFix by applying the same validation to both TX and RX stream counts in\ndetect_stream_formats()."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha corregido la siguiente vulnerabilidad:\\n\\nALSA: dice: corregir desbordamiento de búfer en detect_stream_formats()\\n\\nLa función detect_stream_formats() lee el valor stream_count directamente de un dispositivo FireWire sin validarlo. Esto puede provocar escrituras fuera de los límites cuando un dispositivo malicioso proporciona un valor stream_count mayor que MAX_STREAMS.\\n\\nSe corrige aplicando la misma validación tanto a los contadores de flujo TX como RX en detect_stream_formats()."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"sound/firewire/dice/dice-extension.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "58579c056c1c9510ae6695ed8e01ee05bbdcfb23",
"lessThan": "d6280a5b00cad37d9a9a875849e5bf7ed2fe4950",
"versionType": "git",
"status": "affected"
},
{
"version": "58579c056c1c9510ae6695ed8e01ee05bbdcfb23",
"lessThan": "3cf854cec0eb371da47ff5fe56eab189d7fa623a",
"versionType": "git",
"status": "affected"
},
{
"version": "58579c056c1c9510ae6695ed8e01ee05bbdcfb23",
"lessThan": "4a6ab0f6cc9bdfdfecbf257a46ff4275bd965af4",
"versionType": "git",
"status": "affected"
},
{
"version": "58579c056c1c9510ae6695ed8e01ee05bbdcfb23",
"lessThan": "dea3ed2c16f99f46f97b1a090bf80ecdd6972ce0",
"versionType": "git",
"status": "affected"
},
{
"version": "58579c056c1c9510ae6695ed8e01ee05bbdcfb23",
"lessThan": "c0a1fe1902ad23e6d48e0f68be1258ccf7a163e6",
"versionType": "git",
"status": "affected"
},
{
"version": "58579c056c1c9510ae6695ed8e01ee05bbdcfb23",
"lessThan": "932aa1e80b022419cf9710e970739b7a8794f27c",
"versionType": "git",
"status": "affected"
},
{
"version": "58579c056c1c9510ae6695ed8e01ee05bbdcfb23",
"lessThan": "1e1b3207a53e50d5a66289fffc1f7d52cd9c50f9",
"versionType": "git",
"status": "affected"
},
{
"version": "58579c056c1c9510ae6695ed8e01ee05bbdcfb23",
"lessThan": "324f3e03e8a85931ce0880654e3c3eb38b0f0bba",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"sound/firewire/dice/dice-extension.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.18",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.18",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.248",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.198",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.160",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.120",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.63",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.13",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.2",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e1b3207a53e50d5a66289fffc1f7d52cd9c50f9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/324f3e03e8a85931ce0880654e3c3eb38b0f0bba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3cf854cec0eb371da47ff5fe56eab189d7fa623a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4a6ab0f6cc9bdfdfecbf257a46ff4275bd965af4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/932aa1e80b022419cf9710e970739b7a8794f27c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0a1fe1902ad23e6d48e0f68be1258ccf7a163e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d6280a5b00cad37d9a9a875849e5bf7ed2fe4950",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dea3ed2c16f99f46f97b1a090bf80ecdd6972ce0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}