CVE-2025-68346: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68346 is a buffer overflow vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) DICE driver, specifically within the detect_stream_formats() function. The function reads the stream_count value directly from a connected FireWire device without validating it against the MAX_STREAMS limit, enabling out-of-bounds writes when a malicious device supplies an oversized value. It was disclosed on December 24, 2025, and affects Linux kernel versions from commit 58579c056c1c up to the respective fix commits across stable branches. Patched versions include Linux 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper input validation (CWE-787, Out-of-bounds Write) in the detect_stream_formats() function of the kernel's sound/firewire/dice/dice-stream.c. When a FireWire device is connected, the driver reads the TX and RX stream_count values directly from device registers without capping them against MAX_STREAMS, allowing a malicious or crafted FireWire device to supply an arbitrarily large count and trigger out-of-bounds writes into kernel memory. Exploitation requires local access and physical or logical control over a FireWire device, making the attack vector local with high attack complexity. The fix applies bounds validation to both TX and RX stream counts before use (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation could allow a low-privileged local attacker with access to a malicious FireWire device to achieve out-of-bounds kernel memory writes, potentially leading to arbitrary code execution in kernel context, privilege escalation, system compromise, or denial of service. The vulnerability carries high confidentiality, integrity, and availability impact ratings, meaning a successful attack could result in full system takeover or crash (Red Hat CVE).

The Linux kernel project has released patches addressing this vulnerability in the following stable versions: 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Downstream distributions including Debian (linux 6.1.162-1, 5.10.249-1), Ubuntu (USN-8179-1/2/3/4, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and Oracle Linux have also released updated packages. As a workaround, administrators should disable FireWire interfaces if not required and restrict physical access to systems to prevent connection of untrusted FireWire devices (Red Hat CVE, Red Hat Bugzilla).