CVE-2025-38729: ALSA: usb-audio: Validate UAC3 power domain descriptors, too
Published Sep 4, 2025
·Updated
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
Affected Software
15 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.96.2-1
Microsoft azl3 kernel 6.6.96.2-2
Microsoft cbl2 kernel 5.15.186.1-1
Linux Linux kernel>=4.17<5.4.297
Linux Linux kernel>=5.5<5.10.241
Linux Linux kernel>=5.11<5.15.190
Linux Linux kernel>=5.16<6.1.149
Linux Linux kernel>=6.2<6.6.103
Linux Linux kernel>=6.7<6.12.43
Linux Linux kernel>=6.13<6.15.11
Linux Linux kernel>=6.16<6.16.2
Linux Linux kernel=6.17-rc1
Debian Debian Linux=11.0
debian/linux
6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1
Event History
Sep 4, 2025
CVE Published
via MITRE·03:33 PM
Data Sourced
via MITRE·03:33 PM
Description
Data Sourced
via Red Hat·04:02 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 6, 2025
Data Sourced
via Microsoft·01:02 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-38729?
CVE-2025-38729 has been classified as a medium severity vulnerability in the Linux kernel.
2
How do I fix CVE-2025-38729?
To mitigate CVE-2025-38729, update your Linux kernel to the latest stable version where the vulnerability has been patched.
3
What type of vulnerability is CVE-2025-38729?
CVE-2025-38729 is a vulnerability related to improper validation of UAC3 power domain descriptors in the ALSA USB audio driver.
4
Which versions of the Linux kernel are affected by CVE-2025-38729?
CVE-2025-38729 affects specific versions of the Linux kernel prior to the implementation of the relevant security updates.
5
What are the potential impacts of CVE-2025-38729?
The potential impacts of CVE-2025-38729 include unexpected out-of-bounds accesses that could be exploited by malicious firmware.