CVE-2025-40275: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor. This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference. This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.

Affected products

• Linux Linux: from 4.18, before 5.4.302 (fixed in 5.4.302); from 5.5, before 5.10.247 (fixed in 5.10.247); from 5.11, before 5.15.197 (fixed in 5.15.197); from 5.16, before 6.1.159 (fixed in 6.1.159); from 6.2, before 6.6.117 (fixed in 6.6.117); from 6.7, before 6.12.59 (fixed in 6.12.59); …

Published 2025-12-06. Last modified 2026-06-17.