CVE-2025-68344
Integer Overflow in Linux ALSA Wavefront Sample Validation
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an integer overflow issue in the Linux kernel's ALSA wavefront driver. Specifically, the wavefront_send_sample() function incorrectly handles the sample size validation by casting a 32-bit unsigned integer (u32) to a signed integer (int) for comparison, which can cause an integer overflow. The fix involves using an unsigned comparison to prevent this overflow.
How can this vulnerability impact me? :
The integer overflow in sample size validation could potentially lead to incorrect memory handling, which might cause unexpected behavior such as crashes or memory corruption in the ALSA wavefront driver. This could affect system stability or security depending on how the driver is used.