CVE-2025-68347

What it actually does

The vulnerability is a buffer overflow in ALSA firewire-motu hwdep_read() that writes more data than the user-supplied buffer size when the buffer is smaller than the 8-byte DSP event header.

Why it matters to the business

Affected Linux systems using firewire-motu audio hardware face risk of kernel crashes, instability, or local privilege escalation, though the issue requires local access and specific hardware.

How an attack unfolds

An attacker with local system access opens the hwdep device node and issues a read call supplying a buffer smaller than 8 bytes; the kernel copies the full DSP event header without clamping, overflowing the user buffer and corrupting adjacent memory.

How to fix it

Update the Linux kernel to a version containing commit 16620f0617400746984362c3d6ac547eeae1d35f, which adds min_t() clamping to limit the copy size in hwdep_read().

How to confirm the fix worked

Inspect the hwdep_read() source for the min_t() size clamp or verify the running kernel includes the referenced commit.

Typical attack path

1. Obtain local user access on a Linux system
2. Confirm presence of firewire-motu hardware and the hwdep interface
3. Open the hwdep character device
4. Call read() with a buffer smaller than 8 bytes to trigger the overflow

How to detect it

Search kernel logs and audit trails for unexpected panics or oops messages involving firewire-motu or ALSA hwdep; look for processes performing reads on hwdep character devices with undersized buffers.

What your security team should do

• Apply the kernel update containing the referenced commit on all affected systems
• Disable or restrict access to firewire-motu hwdep interfaces where hardware is not required
• Review kernel logs for ALSA-related panics on systems that cannot be updated immediately