CVE-2025-68347ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provides a buffer smaller than the event header size (8 bytes). Fix by using min_t() to clamp the copy size, This ensures we never copy more than the user requested.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 634ec0b2906efd46f6f57977e172aa3470aca432 before 16620f0617400746984362c3d6ac547eeae1d35f; from 634ec0b2906efd46f6f57977e172aa3470aca432 before ddd32ec66bc4eb6969fe835e4cc1c0706c6348fe; from 634ec0b2906efd46f6f57977e172aa3470aca432 before 6275fd726d53a8ec724f20201cf3bd862711e17b; from 634ec0b2906efd46f6f57977e172aa3470aca432 before 161291bac551821bba98eb4ea84c82338578d1b0; from 634ec0b2906efd46f6f57977e172aa3470aca432 before cdda0d06f8650e33255f79839f188bbece44117c; 634ec0b2906efd46f6f57977e172aa3470aca432 builds before 210d77cca3d0494ed30a5c628b20c1d95fa04fb1 | CNA record |
References
- https://git.kernel.org/stable/c/16620f0617400746984362c3d6ac547eeae1d35f
- https://git.kernel.org/stable/c/ddd32ec66bc4eb6969fe835e4cc1c0706c6348fe
- https://git.kernel.org/stable/c/6275fd726d53a8ec724f20201cf3bd862711e17b
- https://git.kernel.org/stable/c/161291bac551821bba98eb4ea84c82338578d1b0
- https://git.kernel.org/stable/c/cdda0d06f8650e33255f79839f188bbece44117c
- https://git.kernel.org/stable/c/210d77cca3d0494ed30a5c628b20c1d95fa04fb1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.