ALSA: usb-audio: fix OOB write on Type II inbound URBs

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74682
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 16:16:42 UTC
Updated2026-08-22 16:16:42 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u->packets = urb_packs; u->buffer_size = maxsize * u->packets; if (fmt->fmt_type == UAC_FORMAT_TYPE_II) u->packets++; /* for transfer delimiter */ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL); buffer_size is computed from the pre-increment packet count and never recomputed, so for a Type II endpoint the buffer is one packet short of the packet count the URB is built with. prepare_inbound_urb() then lays out one iso frame per packet and never consults buffer_size: offs = 0; for (i = 0; i < urb_ctx->packets; i++) { urb->iso_frame_desc[i].offset = offs; urb->iso_frame_desc[i].length = ep->curpacksize; offs += ep->curpacksize; } urb->transfer_buffer_length = offs; urb->number_of_packets = urb_ctx->packets; The last descriptor therefore points one packet past the end of the transfer buffer, where the host controller writes device data on every inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound their fill loops by ctx->buffer_size, so only capture is affected. fmt_type comes from the device's audio streaming descriptors, so any device advertising a Type II capture format hits this once userspace sets hw_params on the stream. KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report per inbound transfer: BUG: KASAN: slab-out-of-bounds in dummy_timer Write of size 64 at addr ffff0000186171c0 by task cons02/166 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 166: usb_alloc_coherent snd_usb_endpoint_set_params The buggy address is located 0 bytes to the right of allocated 64-byte region [ffff000018617180, ffff0000186171c0) Compute buffer_size after the delimiter packet has been accounted for, and bound the fill loop by buffer_size, as prepare_silent_urb() already does on the outbound side. This grows every Type II URB allocation by one maxsize packet. Discovered by XBOW, triaged by Baul Lee <[email protected]>

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 8fdff6a319e7dac757c558bd283dc4577e68cde7 6af5f29af7711233ae68d3b25c15d67478468900 git Not specified
CNA Linux Linux affected 8fdff6a319e7dac757c558bd283dc4577e68cde7 f1fbb50b99311b35c2e85cc70341d62082dca4b5 git Not specified
CNA Linux Linux affected 8fdff6a319e7dac757c558bd283dc4577e68cde7 137bf034740e5a2734794908d0aff1e0bd7cee6e git Not specified
CNA Linux Linux affected 8fdff6a319e7dac757c558bd283dc4577e68cde7 6607f85242577f33d4540a0d1f4a6137f5367058 git Not specified
CNA Linux Linux affected 8fdff6a319e7dac757c558bd283dc4577e68cde7 ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a git Not specified
CNA Linux Linux affected 8fdff6a319e7dac757c558bd283dc4577e68cde7 0a235379825e1a6194e43861ee6658e5fc35686d git Not specified
CNA Linux Linux affected 8fdff6a319e7dac757c558bd283dc4577e68cde7 d3ed4e6321bb453757044cb9e5ecb30a33f04903 git Not specified
CNA Linux Linux affected 8fdff6a319e7dac757c558bd283dc4577e68cde7 69ee44e1a23be62318189dc4b37fa4ad94053269 git Not specified
CNA Linux Linux affected 3.5 Not specified
CNA Linux Linux unaffected 3.5 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.152 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.104 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report