Not yet scoredPublished Jan 13, 2026

CVE-2025-68783ALSA: usb-mixer: us16x08: validate meter packet indices

Updated under an hour ago (Oct 27, 2026, 10:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_level[] and master_level[] in struct snd_us16x08_meter_store. Currently the function derives the channel index directly from the meter packet (MUB2(meter_urb, s) - 1) and uses it to index those arrays without validating the range. If the packet contains a negative or out-of-range channel number, the driver may write past the end of these arrays. Introduce a local channel variable and validate it before updating the arrays. We reject negative indices, limit meter_level[] and comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] updates with ARRAY_SIZE(master_level).

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d2bb390a2081a36ffe906724d2848d846f2aeb29 before 53461710a95e15ac1f6542450943a492ecf8e550; from d2bb390a2081a36ffe906724d2848d846f2aeb29 before 2168866396bd28ec4f3c8da0fbc7d08b5bd4f053; from d2bb390a2081a36ffe906724d2848d846f2aeb29 before cde47f4ccad6751ac36b7471572ddf38ee91870c; from d2bb390a2081a36ffe906724d2848d846f2aeb29 before 2f21a7cbaaa93926f5be15bc095b9c57c35748d9; from d2bb390a2081a36ffe906724d2848d846f2aeb29 before a8ad320efb663be30b794e3dd3e829301c0d0ed3; from d2bb390a2081a36ffe906724d2848d846f2aeb29 before eaa95228b8a56c4880a182c0350d67922b22408f; from d2bb390a2081a36ffe906724d2848d846f2aeb29 before 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e	CNA record

References

References

https://git.kernel.org/stable/c/53461710a95e15ac1f6542450943a492ecf8e550
https://git.kernel.org/stable/c/2168866396bd28ec4f3c8da0fbc7d08b5bd4f053
https://git.kernel.org/stable/c/cde47f4ccad6751ac36b7471572ddf38ee91870c
https://git.kernel.org/stable/c/2f21a7cbaaa93926f5be15bc095b9c57c35748d9
https://git.kernel.org/stable/c/a8ad320efb663be30b794e3dd3e829301c0d0ed3
https://git.kernel.org/stable/c/eaa95228b8a56c4880a182c0350d67922b22408f
https://git.kernel.org/stable/c/5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.