CVE-2025-38729

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-25)

CWE

CWE-787

Published

2025-09-04

Modified

2026-10-19

Record from

the NVD, synced 2026-10-21

Affected

• debian:debian_linux
• linux:linux_kernel

References

• https://git.kernel.org/stable/c/07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dc
• https://git.kernel.org/stable/c/1666207ba0a5973735ef010812536adde6174e81
• https://git.kernel.org/stable/c/29b415ec09f5b9d1dfa2423b826725a8c8796b9a
• https://git.kernel.org/stable/c/40714daf4d0448e1692c78563faf0ed0f9d9b5c7
• https://git.kernel.org/stable/c/452ad54f432675982cc0d6eb6c40a6c86ac61dbd

Check your stackJSON