CVE-2025-68783 ALSA: usb-mixer: us16x08: validate meter packet indices
A missing bounds check in the Linux kernel USB mixer driver allows out-of-bounds writes, potentially enabling local privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68783?
CVE-2025-68783 is a memory corruption vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-mixer: us16x08: validate meter packet indices
get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_level[] and master_level[] in struct snd_us16x08_meter_store.
Currently the function derives the channel index directly from the meter packet (MUB2(meter_urb, s) - 1) and uses it to index those arrays without validating the range. If the packet contains a negative or out-of-range channel number, the driver may write past the end of these arrays.
Introduce a local channel variable and validate it before updating the arrays. We reject negative indices, limit meter_level[] and comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] updates with ARRAY_SIZE(master_level).
Which versions are affected by CVE-2025-68783?
How do I fix CVE-2025-68783?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-68783 being exploited?
There is no known exploitation of CVE-2025-68783 in the wild and no public exploit code.
Sources
Also known as AZL-74372, BELL-CVE-2025-68783, DEBIAN-CVE-2025-68783, GHSA-8vvr-5pch-2fhg, ROOT-OS-DEBIAN-11-CVE-2025-68783, ROOT-OS-DEBIAN-12-CVE-2025-68783 and 4 more.