CVE-2025-68346

What it actually does

Unvalidated stream_count read from a FireWire device in detect_stream_formats() allows out-of-bounds writes when the value exceeds MAX_STREAMS, affecting both TX and RX paths in the ALSA dice driver.

Why it matters to the business

Systems using FireWire audio hardware may experience kernel instability or crashes when a malicious or malformed device is connected, potentially disrupting operations on affected Linux deployments with downstream package dependencies.

How an attack unfolds

An attacker presents a FireWire device that supplies an excessively large stream_count value during driver initialization; the kernel reads this value without bounds checking and performs writes beyond allocated buffers in detect_stream_formats().

How to fix it

Apply the upstream kernel fix from commit d6280a5b00cad37d9a9a875849e5bf7ed2fe4950 or equivalent stable releases that add validation for both TX and RX stream counts; update affected packages to versions containing this change.

How to confirm the fix worked

Confirm the patch is present by inspecting the detect_stream_formats() function for added bounds checks on stream_count values, and verify the running kernel includes the referenced commit or later.

Typical attack path

1. Physically connect a malicious or crafted FireWire device to the target system
2. Linux kernel loads the ALSA dice driver upon device detection
3. detect_stream_formats() reads the unvalidated stream_count from the device
4. Out-of-bounds memory writes occur leading to potential kernel compromise

How to detect it

Review kernel logs for ALSA dice driver errors, buffer overflow indicators, or crashes triggered immediately after FireWire device enumeration; examine dmesg or syslog entries around device hotplug events.

What your security team should do

• Prioritize kernel updates containing the ALSA dice validation fix across all affected systems
• Disable FireWire interfaces or the dice driver if the hardware is not required
• Monitor for kernel oops or crashes associated with FireWire audio device attachment