ALSA: usb-audio: fix stack info leak in RME Digiface status

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74500
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 13:17:54 UTC
Updated2026-08-15 13:17:54 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd_rme_digiface_read_status() reads a four-word status block from the device into an uninitialised on-stack __le32 buf[4] and, whenever the vendor control-IN transfer does not return a negative error, copies all four words into the caller's status[]. snd_usb_ctl_msg() copies the full requested size back into the caller's buffer regardless of how many bytes the data stage actually delivered: buf = kmemdup(data, size, GFP_KERNEL); err = usb_control_msg(dev, pipe, request, requesttype, value, index, buf, size, timeout); memcpy(data, buf, size); usb_control_msg() returns the transferred length on a short control-IN, which is a non-negative value, and writes only that many bytes. The remainder of the copy back is the kmemdup()ed image of the caller's buffer, so a device answering with a short data stage leaves the trailing words of buf[] holding leftover kernel stack. The only guard in the caller is err < 0, so those words are stored into status[]. They then reach user space: snd_rme_digiface_get_status_val() selects a 16-bit halfword of status[] per the control's reg/mask, and the eight Digiface status controls together expose the whole 16-byte frame to an unprivileged reader of /dev/snd/controlC*. Zero-initialise the buffer so a short read yields zeros instead of stack residue. This mirrors snd_rme_get_status1(), which already clears its output word before the same kind of vendor read. Discovered by XBOW, triaged by Baul Lee <[email protected]>

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 611a96f6acf2e74fe28cb90908a9c183862348ce b3a346d5c99dd73cf84711f2a43e42691990efd2 git Not specified
CNA Linux Linux affected 611a96f6acf2e74fe28cb90908a9c183862348ce 7ba01e0d3539d9cf0aef3e82938f1648147744cc git Not specified
CNA Linux Linux affected 611a96f6acf2e74fe28cb90908a9c183862348ce 98dbfbb38e297c25c5b0af4a9018d71ac25e8554 git Not specified
CNA Linux Linux affected 611a96f6acf2e74fe28cb90908a9c183862348ce 441aaad150c57edaf57ee482a79a3bf4c5b7e353 git Not specified
CNA Linux Linux affected 3089703ab71484a8b9a7641051181d11d60f870c git Not specified
CNA Linux Linux affected 50f63f11a6ddaa0d34574df72b3fa6ee257c057d git Not specified
CNA Linux Linux affected 6.10.14 6.11 semver Not specified
CNA Linux Linux affected 6.11.3 6.12 semver Not specified
CNA Linux Linux affected 6.12 Not specified
CNA Linux Linux unaffected 6.12 semver Not specified
CNA Linux Linux unaffected 6.12.103 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.44 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.8 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc6 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/441aaad150c57edaf57ee482a79a3bf4c5b7e353 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/98dbfbb38e297c25c5b0af4a9018d71ac25e8554 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7ba01e0d3539d9cf0aef3e82938f1648147744cc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b3a346d5c99dd73cf84711f2a43e42691990efd2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report