ALSA: usb-audio: Clamp frame size in implicit-feedback mode

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74497
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 13:17:54 UTC
Updated2026-08-19 17:21:06 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize. The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits. Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue.

Risk And Classification

Primary CVSS: v3.1 8.4 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001420000 probability, percentile 0.039840000 (date 2026-08-19)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED8.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 28acb12014fb0c3e1edfdab1b1e3e266cf651550 2d39fea6d3c19a2f5811d123114d92e3d0115fd1 git Not specified
CNA Linux Linux affected 28acb12014fb0c3e1edfdab1b1e3e266cf651550 09cf3dbbb4256a43feb91d2f51f274510a9ada47 git Not specified
CNA Linux Linux affected 28acb12014fb0c3e1edfdab1b1e3e266cf651550 cfa8d3e0e8b812c4db4d5241f62b6bdbab2bd7be git Not specified
CNA Linux Linux affected 28acb12014fb0c3e1edfdab1b1e3e266cf651550 56ac3e7c90f6b45969c3fd07a98fad760ffd6901 git Not specified
CNA Linux Linux affected 28acb12014fb0c3e1edfdab1b1e3e266cf651550 be97fea7451d758881b95af78e900dd0d58a382a git Not specified
CNA Linux Linux affected 28acb12014fb0c3e1edfdab1b1e3e266cf651550 2db4535d6af79276a64449201c5be5feffb31c64 git Not specified
CNA Linux Linux affected 28acb12014fb0c3e1edfdab1b1e3e266cf651550 53f0aa37eb945f3c983f61d12fc35eb33debb8a9 git Not specified
CNA Linux Linux affected 28acb12014fb0c3e1edfdab1b1e3e266cf651550 8d7a30c50c2e58a6839634ed0acde14466d1dc61 git Not specified
CNA Linux Linux affected 3.8 Not specified
CNA Linux Linux unaffected 3.8 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.151 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.103 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.44 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.8 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/cfa8d3e0e8b812c4db4d5241f62b6bdbab2bd7be 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/be97fea7451d758881b95af78e900dd0d58a382a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/09cf3dbbb4256a43feb91d2f51f274510a9ada47 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/53f0aa37eb945f3c983f61d12fc35eb33debb8a9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/56ac3e7c90f6b45969c3fd07a98fad760ffd6901 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2d39fea6d3c19a2f5811d123114d92e3d0115fd1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8d7a30c50c2e58a6839634ed0acde14466d1dc61 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2db4535d6af79276a64449201c5be5feffb31c64 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report