CVE-2025-68783 (GCVE-0-2025-68783)
Vulnerability from cvelistv5 – Published: 2026-01-13 15:28 – Updated: 2026-05-11 21:53
VLAI
EPSS
VEX
Title
ALSA: usb-mixer: us16x08: validate meter packet indices
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-mixer: us16x08: validate meter packet indices
get_meter_levels_from_urb() parses the 64-byte meter packets sent by
the device and fills the per-channel arrays meter_level[],
comp_level[] and master_level[] in struct snd_us16x08_meter_store.
Currently the function derives the channel index directly from the
meter packet (MUB2(meter_urb, s) - 1) and uses it to index those
arrays without validating the range. If the packet contains a
negative or out-of-range channel number, the driver may write past
the end of these arrays.
Introduce a local channel variable and validate it before updating the
arrays. We reject negative indices, limit meter_level[] and
comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]
updates with ARRAY_SIZE(master_level).
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
d2bb390a2081a36ffe906724d2848d846f2aeb29 , < 53461710a95e15ac1f6542450943a492ecf8e550
(git)
Affected: d2bb390a2081a36ffe906724d2848d846f2aeb29 , < 2168866396bd28ec4f3c8da0fbc7d08b5bd4f053 (git) Affected: d2bb390a2081a36ffe906724d2848d846f2aeb29 , < cde47f4ccad6751ac36b7471572ddf38ee91870c (git) Affected: d2bb390a2081a36ffe906724d2848d846f2aeb29 , < 2f21a7cbaaa93926f5be15bc095b9c57c35748d9 (git) Affected: d2bb390a2081a36ffe906724d2848d846f2aeb29 , < a8ad320efb663be30b794e3dd3e829301c0d0ed3 (git) Affected: d2bb390a2081a36ffe906724d2848d846f2aeb29 , < eaa95228b8a56c4880a182c0350d67922b22408f (git) Affected: d2bb390a2081a36ffe906724d2848d846f2aeb29 , < 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e (git) |
guessed | |
| Linux | Linux |
Affected:
4.11
Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.198 , ≤ 5.15.* (semver) Unaffected: 6.1.160 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.64 , ≤ 6.12.* (semver) Unaffected: 6.18.3 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_us16x08.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "53461710a95e15ac1f6542450943a492ecf8e550",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "2168866396bd28ec4f3c8da0fbc7d08b5bd4f053",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "cde47f4ccad6751ac36b7471572ddf38ee91870c",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "2f21a7cbaaa93926f5be15bc095b9c57c35748d9",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "a8ad320efb663be30b794e3dd3e829301c0d0ed3",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "eaa95228b8a56c4880a182c0350d67922b22408f",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_us16x08.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.248",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.198",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.120",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.64",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.3",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-mixer: us16x08: validate meter packet indices\n\nget_meter_levels_from_urb() parses the 64-byte meter packets sent by\nthe device and fills the per-channel arrays meter_level[],\ncomp_level[] and master_level[] in struct snd_us16x08_meter_store.\n\nCurrently the function derives the channel index directly from the\nmeter packet (MUB2(meter_urb, s) - 1) and uses it to index those\narrays without validating the range. If the packet contains a\nnegative or out-of-range channel number, the driver may write past\nthe end of these arrays.\n\nIntroduce a local channel variable and validate it before updating the\narrays. We reject negative indices, limit meter_level[] and\ncomp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]\nupdates with ARRAY_SIZE(master_level)."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:53:16.125Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/53461710a95e15ac1f6542450943a492ecf8e550"
},
{
"url": "https://git.kernel.org/stable/c/2168866396bd28ec4f3c8da0fbc7d08b5bd4f053"
},
{
"url": "https://git.kernel.org/stable/c/cde47f4ccad6751ac36b7471572ddf38ee91870c"
},
{
"url": "https://git.kernel.org/stable/c/2f21a7cbaaa93926f5be15bc095b9c57c35748d9"
},
{
"url": "https://git.kernel.org/stable/c/a8ad320efb663be30b794e3dd3e829301c0d0ed3"
},
{
"url": "https://git.kernel.org/stable/c/eaa95228b8a56c4880a182c0350d67922b22408f"
},
{
"url": "https://git.kernel.org/stable/c/5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e"
}
],
"title": "ALSA: usb-mixer: us16x08: validate meter packet indices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68783",
"datePublished": "2026-01-13T15:28:57.609Z",
"dateReserved": "2025-12-24T10:30:51.036Z",
"dateUpdated": "2026-05-11T21:53:16.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-68783",
"date": "2026-11-07",
"epss": "0.00207",
"percentile": "0.10832"
},
"microsoft_vex": {
"current_release_date": "2026-02-18T14:23:52.000Z",
"cve": "CVE-2025-68783",
"id": "msrc_CVE-2025-68783",
"initial_release_date": "2026-01-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "ALSA: usb-mixer: us16x08: validate meter packet indices",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-68783.json",
"version": "3"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_us16x08.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "53461710a95e15ac1f6542450943a492ecf8e550",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "2168866396bd28ec4f3c8da0fbc7d08b5bd4f053",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "cde47f4ccad6751ac36b7471572ddf38ee91870c",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "2f21a7cbaaa93926f5be15bc095b9c57c35748d9",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "a8ad320efb663be30b794e3dd3e829301c0d0ed3",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "eaa95228b8a56c4880a182c0350d67922b22408f",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
},
{
"lessThan": "5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e",
"status": "affected",
"version": "d2bb390a2081a36ffe906724d2848d846f2aeb29",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_us16x08.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-mixer: us16x08: validate meter packet indices\n\nget_meter_levels_from_urb() parses the 64-byte meter packets sent by\nthe device and fills the per-channel arrays meter_level[],\ncomp_level[] and master_level[] in struct snd_us16x08_meter_store.\n\nCurrently the function derives the channel index directly from the\nmeter packet (MUB2(meter_urb, s) - 1) and uses it to index those\narrays without validating the range. If the packet contains a\nnegative or out-of-range channel number, the driver may write past\nthe end of these arrays.\n\nIntroduce a local channel variable and validate it before updating the\narrays. We reject negative indices, limit meter_level[] and\ncomp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]\nupdates with ARRAY_SIZE(master_level)."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: usb-mixer: us16x08: validar los \u00edndices de los paquetes de medidor\n\nget_meter_levels_from_urb() analiza los paquetes de medidor de 64 bytes enviados por el dispositivo y rellena los arrays por canal meter_level[], comp_level[] y master_level[] en la estructura snd_us16x08_meter_store.\n\nActualmente, la funci\u00f3n deriva el \u00edndice del canal directamente del paquete de medidor (MUB2(meter_urb, s) - 1) y lo usa para indexar esos arrays sin validar el rango. Si el paquete contiene un n\u00famero de canal negativo o fuera de rango, el controlador puede escribir m\u00e1s all\u00e1 del final de estos arrays.\n\nIntroduce una variable de canal local y val\u00eddala antes de actualizar los arrays. Rechazamos los \u00edndices negativos, limitamos meter_level[] y comp_level[] a SND_US16X08_MAX_CHANNELS, y protegemos las actualizaciones de master_level[] con ARRAY_SIZE(master_level)."
}
],
"id": "CVE-2025-68783",
"lastModified": "2026-06-17T09:59:34.920",
"metrics": {},
"published": "2026-01-13T16:15:58.000",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2168866396bd28ec4f3c8da0fbc7d08b5bd4f053"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2f21a7cbaaa93926f5be15bc095b9c57c35748d9"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/53461710a95e15ac1f6542450943a492ecf8e550"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a8ad320efb663be30b794e3dd3e829301c0d0ed3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/cde47f4ccad6751ac36b7471572ddf38ee91870c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/eaa95228b8a56c4880a182c0350d67922b22408f"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Deferred"
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-11-07T04:45:59+00:00",
"cve": "CVE-2025-68783",
"id": "CVE-2025-68783",
"initial_release_date": "2025-01-01T00:00:00+00:00",
"product_status:known_affected": "186",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: ALSA: usb-mixer: us16x08: validate meter packet indices",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68783.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.