{"id":"CVE-2025-68346","state":"PUBLISHED","title":"ALSA: dice: fix buffer overflow in detect_stream_formats()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: dice: fix buffer overflow in detect_stream_formats()\n\nThe function detect_stream_formats() reads the stream_count value directly\nfrom a FireWire device without validating it. This can lead to\nout-of-bounds writes when a malicious device provides a stream_count value\ngreater than MAX_STREAMS.\n\nFix by applying the same validation to both TX and RX stream counts in\ndetect_stream_formats().","publishedAt":"2025-12-24T10:32:39.101Z","updatedAt":"2026-05-11T21:51:25.174Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"d6280a5b00cad37d9a9a875849e5bf7ed2fe4950","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"3cf854cec0eb371da47ff5fe56eab189d7fa623a","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"4a6ab0f6cc9bdfdfecbf257a46ff4275bd965af4","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"dea3ed2c16f99f46f97b1a090bf80ecdd6972ce0","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"c0a1fe1902ad23e6d48e0f68be1258ccf7a163e6","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"932aa1e80b022419cf9710e970739b7a8794f27c","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"1e1b3207a53e50d5a66289fffc1f7d52cd9c50f9","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"324f3e03e8a85931ce0880654e3c3eb38b0f0bba","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/firewire/dice/dice-extension.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.18","versionType":"semver"},{"version":"5.10.248","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.198","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.160","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.120","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.63","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.13","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18.2","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/firewire/dice/dice-extension.c"]}],"references":["https://git.kernel.org/stable/c/d6280a5b00cad37d9a9a875849e5bf7ed2fe4950","https://git.kernel.org/stable/c/3cf854cec0eb371da47ff5fe56eab189d7fa623a","https://git.kernel.org/stable/c/4a6ab0f6cc9bdfdfecbf257a46ff4275bd965af4","https://git.kernel.org/stable/c/dea3ed2c16f99f46f97b1a090bf80ecdd6972ce0","https://git.kernel.org/stable/c/c0a1fe1902ad23e6d48e0f68be1258ccf7a163e6","https://git.kernel.org/stable/c/932aa1e80b022419cf9710e970739b7a8794f27c","https://git.kernel.org/stable/c/1e1b3207a53e50d5a66289fffc1f7d52cd9c50f9","https://git.kernel.org/stable/c/324f3e03e8a85931ce0880654e3c3eb38b0f0bba"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/68xxx/CVE-2025-68346.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68346","state":"PUBLISHED","datePublished":"2025-12-24T10:32:39.101Z","dateUpdated":"2026-05-11T21:51:25.174Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-16T14:48:05.299Z"},"containers":{"cna":{"title":"ALSA: dice: fix buffer overflow in detect_stream_formats()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: dice: fix buffer overflow in detect_stream_formats()\n\nThe function detect_stream_formats() reads the stream_count value directly\nfrom a FireWire device without validating it. This can lead to\nout-of-bounds writes when a malicious device provides a stream_count value\ngreater than MAX_STREAMS.\n\nFix by applying the same validation to both TX and RX stream counts in\ndetect_stream_formats()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"d6280a5b00cad37d9a9a875849e5bf7ed2fe4950","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"3cf854cec0eb371da47ff5fe56eab189d7fa623a","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"4a6ab0f6cc9bdfdfecbf257a46ff4275bd965af4","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"dea3ed2c16f99f46f97b1a090bf80ecdd6972ce0","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"c0a1fe1902ad23e6d48e0f68be1258ccf7a163e6","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"932aa1e80b022419cf9710e970739b7a8794f27c","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"1e1b3207a53e50d5a66289fffc1f7d52cd9c50f9","versionType":"git"},{"version":"58579c056c1c9510ae6695ed8e01ee05bbdcfb23","status":"affected","lessThan":"324f3e03e8a85931ce0880654e3c3eb38b0f0bba","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/firewire/dice/dice-extension.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.18","versionType":"semver"},{"version":"5.10.248","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.198","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.160","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.120","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.63","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.13","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18.2","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/firewire/dice/dice-extension.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d6280a5b00cad37d9a9a875849e5bf7ed2fe4950"},{"url":"https://git.kernel.org/stable/c/3cf854cec0eb371da47ff5fe56eab189d7fa623a"},{"url":"https://git.kernel.org/stable/c/4a6ab0f6cc9bdfdfecbf257a46ff4275bd965af4"},{"url":"https://git.kernel.org/stable/c/dea3ed2c16f99f46f97b1a090bf80ecdd6972ce0"},{"url":"https://git.kernel.org/stable/c/c0a1fe1902ad23e6d48e0f68be1258ccf7a163e6"},{"url":"https://git.kernel.org/stable/c/932aa1e80b022419cf9710e970739b7a8794f27c"},{"url":"https://git.kernel.org/stable/c/1e1b3207a53e50d5a66289fffc1f7d52cd9c50f9"},{"url":"https://git.kernel.org/stable/c/324f3e03e8a85931ce0880654e3c3eb38b0f0bba"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:51:25.174Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"5.10.248"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"5.15.198"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.1.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.6.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.12.63"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.17.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.18.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.19"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}