High 7.8Published Dec 24, 2025

CVE-2025-68347ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

Updated under an hour ago (Oct 28, 2026, 4:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provides a buffer smaller than the event header size (8 bytes). Fix by using min_t() to clamp the copy size, This ensures we never copy more than the user requested.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 634ec0b2906efd46f6f57977e172aa3470aca432 before 16620f0617400746984362c3d6ac547eeae1d35f; from 634ec0b2906efd46f6f57977e172aa3470aca432 before ddd32ec66bc4eb6969fe835e4cc1c0706c6348fe; from 634ec0b2906efd46f6f57977e172aa3470aca432 before 6275fd726d53a8ec724f20201cf3bd862711e17b; from 634ec0b2906efd46f6f57977e172aa3470aca432 before 161291bac551821bba98eb4ea84c82338578d1b0; from 634ec0b2906efd46f6f57977e172aa3470aca432 before cdda0d06f8650e33255f79839f188bbece44117c; 634ec0b2906efd46f6f57977e172aa3470aca432 builds before 210d77cca3d0494ed30a5c628b20c1d95fa04fb1	CNA record

References

References

https://git.kernel.org/stable/c/16620f0617400746984362c3d6ac547eeae1d35f
https://git.kernel.org/stable/c/ddd32ec66bc4eb6969fe835e4cc1c0706c6348fe
https://git.kernel.org/stable/c/6275fd726d53a8ec724f20201cf3bd862711e17b
https://git.kernel.org/stable/c/161291bac551821bba98eb4ea84c82338578d1b0
https://git.kernel.org/stable/c/cdda0d06f8650e33255f79839f188bbece44117c
https://git.kernel.org/stable/c/210d77cca3d0494ed30a5c628b20c1d95fa04fb1

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.