CVE-2025-39757

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.

CVSS 3.1

7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-125

Published

2025-09-11

Modified

2026-10-19

Record from

the NVD, synced 2026-10-21

Affected

• debian:debian_linux
• linux:linux_kernel

References

• https://git.kernel.org/stable/c/1034719fdefd26caeec0a44a868bb5a412c2c1a5
• https://git.kernel.org/stable/c/275e37532e8ebe25e8a4069b2d9f955bfd202a46
• https://git.kernel.org/stable/c/47ab3d820cb0a502bd0074f83bb3cf7ab5d79902
• https://git.kernel.org/stable/c/786571b10b1ae6d90e1242848ce78ee7e1d493c4
• https://git.kernel.org/stable/c/799c06ad4c9c790c265e8b6b94947213f1fb389c

Check your stackJSON