Skip to main content

Linux Kernel CVE-2025-68347

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.5 MEDIUM

Local access and low-privilege hwdep access give AV:L/PR:L; the required niche MOTU FireWire hardware and event timing raise AC:H; overflow into the caller's own buffer limits impact to Low across C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:07 vuln.today
CVE Published
Dec 24, 2025 - 11:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provides a buffer smaller than the event header size (8 bytes).

Fix by using min_t() to clamp the copy size, This ensures we never copy more than the user requested.

AnalysisAI

Local memory corruption in the Linux kernel's ALSA firewire-motu driver allows a user to trigger a buffer overflow when reading DSP events from the hwdep interface with an undersized buffer. The hwdep_read() path copied the full 8-byte DSP event header regardless of the caller-supplied buffer length, writing past the end of the user-provided buffer; the fix clamps the copy with min_t(). There is no public exploit identified at time of analysis, and EPSS is low (0.20%), consistent with a niche driver requiring MOTU FireWire audio hardware.

Technical ContextAI

The affected code is the FireWire MOTU (Mark of the Unicorn) sound driver (snd-firewire-motu) within the ALSA subsystem, which exposes a character hwdep device for delivering DSP metering/event data to userspace. In hwdep_read(), each DSP event carries an 8-byte header, and the routine copied that fixed header size into the destination without validating it against the length the caller passed to read(2). This is a classic out-of-bounds write / buffer overflow root cause (CWE-787 / CWE-120 class; the input listed CWE as N/A), where a length check is missing before copy_to_user, so a caller requesting fewer than 8 bytes receives more data than its buffer can hold.

Affected ProductsAI

The Linux kernel's ALSA firewire-motu driver is affected on systems using MOTU FireWire audio interfaces. Exact vulnerable version ranges are not enumerated in the provided data, but the six git.kernel.org stable references (commits 161291ba, 16620f06, 210d77cc, 6275fd72, cdda0d06, ddd32ec6 at https://git.kernel.org/stable/) indicate the fix was backported across multiple stable series, implying a broad range of prior kernel versions containing the flawed hwdep_read() path are impacted until patched. No distinct downstream vendor advisory URL is included beyond the kernel.org stable-tree commits.

RemediationAI

Upstream fix available (multiple stable-tree commits); a specific released tagged kernel version is not independently confirmed in the provided data - update to the latest patched kernel from your distribution that incorporates the firewire-motu hwdep_read() min_t() clamp (see https://git.kernel.org/stable/c/161291bac551821bba98eb4ea84c82338578d1b0 and the five sibling commits). As a compensating control until patched, unload or blacklist the snd-firewire-motu module (e.g. blacklist it in modprobe configuration) on systems that do not use MOTU FireWire audio hardware, which eliminates the attack surface entirely with no functional loss for non-MOTU deployments; where the hardware is in use, restrict access to the ALSA hwdep device nodes to trusted users/groups only, accepting that this limits legitimate low-privilege audio applications from reading DSP events.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-68347 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy