CVE-2024-53150

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

High 7.1
Exploited: added to CISA KEV 9 Apr 2025

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

Key facts

Published: 24 Dec 2024
Last changed: 23 May 2026
Assigned by: Linux
KEV added: 9 Apr 2025
KEV fix due: 30 Apr 2025
EPSS: 1.354% likely to be exploited in the next 30 days, higher than 72.05% of CVEs (scores for 15 Nov 2026)
SSVC (CISA): Exploitation: active; Automatable: no; Technical impact: partial

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

7.1CVSS 3.1, Highfrom CISA (ADP container)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
Linux	Linux	Default status: unaffected b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to but excluding a632bdcb359fd8145e86486ff8612da98e239acd (affected) b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to but excluding 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b (affected) b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to but excluding ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9 (affected) b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to but excluding da13ade87a12dd58829278bc816a61bea06a56a9 (affected) b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to but excluding 74cb86e1006c5437b1d90084d22018da30fddc77 (affected) b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to but excluding ea0fa76f61cf8e932d1d26e6193513230816e11d (affected) b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to but excluding 096bb5b43edf755bc4477e64004fa3a20539ec2f (affected) b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to but excluding a3dd4d63eeb452cfb064a13862fb376ab108f6a6 (affected) 9feeaa50e5b4b0b71259d918a36ecf9059e60796 (affected) 3b17a13b687ae99939dc94a4ae01fbc34f68decc (affected) 4.19.84 up to but excluding 4.20 (affected) 5.3.11 up to but excluding 5.4 (affected)
Linux	Linux	Default status: affected 5.4 (affected) 0 up to but excluding 5.4 (unaffected) 5.4.287 up to and including 5.4.* (unaffected) 5.10.231 up to and including 5.10.* (unaffected) 5.15.174 up to and including 5.15.* (unaffected) 6.1.120 up to and including 6.1.* (unaffected) 6.6.64 up to and including 6.6.* (unaffected) 6.11.11 up to and including 6.11.* (unaffected) 6.12.2 up to and including 6.12.* (unaffected) 6.13 up to and including * (unaffected)