CVE-2026-74682

CVE CVE-2026-74682EUVD EUVD-2026-64369Published 2026-08-22T15:32:49.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u->packets = urb_packs; u->buffer_size = maxsize * u->packets; if (fmt->fmt_type == UAC_FORMAT_TYPE_II) u->packets++; /* for transfer delimiter */ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL); buffer_size is computed from the pre-increment packet count and never recomputed, so for a Type II endpoint the buffer is one packet short of the packet count the URB is built with. prepare_inbound_urb() then lays out one iso frame per packet and never consults buffer_size: offs = 0; for (i = 0; i < urb_ctx->packets; i++) { urb->iso_frame_desc[i].offset = offs; urb->iso_frame_desc[i].length = ep->curpacksize; offs += ep->curpacksize; } urb->transfer_buffer_length = offs; urb->number_of_packets = urb_ctx->packets; The last descriptor therefore points one packet past the end of the transfer buffer, where the host controller writes device data on every inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound their fill loops by ctx->buffer_size, so only capture is affected. fmt_type comes from the device's audio streaming descriptors, so any device advertising a Type II capture format hits this once userspace sets hw_params on the stream. KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report per inbound transfer: BUG: KASAN: slab-out-of-bounds in dummy_timer Write of size 64 at addr ffff0000186171c0 by task cons02/166 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 166: usb_alloc_coherent snd_usb_endpoint_set_params The buggy address is located 0 bytes to the right of allocated 64-byte region [ffff000018617180, ffff0000186171c0) Compute buffer_size after the delimiter packet has been accounted for, and bound the fill loop by buffer_size, as prepare_silent_urb() already does on the outbound side. This grows every Type II URB allocation by one maxsize packet. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 8fdff6a319e7dac757c558bd283dc4577e68cde7 <0a235379825e1a6194e43861ee6658e5fc35686d; patch: 5.15.216; patch: 0; 8fdff6a319e7dac757c558bd283dc4577e68cde7 <6af5f29af7711233ae68d3b25c15d67478468900; 8fdff6a319e7dac757c558bd283dc4577e68cde7 <d3ed4e6321bb453757044cb9e5ecb30a33f04903; patch: 6.1.183; patch: 6.12.104; 8fdff6a319e7dac757c558bd283dc4577e68cde7 <137bf034740e5a2734794908d0aff1e0bd7cee6e; 8fdff6a319e7dac757c558bd283dc4577e68cde7 <6607f85242577f33d4540a0d1f4a6137f5367058; 8fdff6a319e7dac757c558bd283dc4577e68cde7 <f1fbb50b99311b35c2e85cc70341d62082dca4b5; patch: 7.2; patch: 6.6.152; patch: 6.18.45; patch: 5.10.265; 3.5; 8fdff6a319e7dac757c558bd283dc4577e68cde7 <69ee44e1a23be62318189dc4b37fa4ad94053269; patch: 7.1.9; 8fdff6a319e7dac757c558bd283dc4577e68cde7 <ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.