CVE-2026-74682 - Vulnerability Details

- ALSA: usb-audio: fix OOB write on Type II inbound URBs

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write on Type II inbound URBs

data_ep_set_params() sizes each URB transfer buffer before it adds the
Format Type II transfer delimiter:

u->packets = urb_packs;
u->buffer_size = maxsize * u->packets;

if (fmt->fmt_type == UAC_FORMAT_TYPE_II)
u->packets++; /* for transfer delimiter */
u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);

buffer_size is computed from the pre-increment packet count and never
recomputed, so for a Type II endpoint the buffer is one packet short of
the packet count the URB is built with.

prepare_inbound_urb() then lays out one iso frame per packet and never
consults buffer_size:

offs = 0;
for (i = 0; i < urb_ctx->packets; i++) {
urb->iso_frame_desc[i].offset = offs;
urb->iso_frame_desc[i].length = ep->curpacksize;
offs += ep->curpacksize;
}

urb->transfer_buffer_length = offs;
urb->number_of_packets = urb_ctx->packets;

The last descriptor therefore points one packet past the end of the
transfer buffer, where the host controller writes device data on every
inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound
their fill loops by ctx->buffer_size, so only capture is affected.

fmt_type comes from the device's audio streaming descriptors, so any
device advertising a Type II capture format hits this once userspace sets
hw_params on the stream.

KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report
per inbound transfer:

BUG: KASAN: slab-out-of-bounds in dummy_timer
Write of size 64 at addr ffff0000186171c0 by task cons02/166
__asan_memcpy
dummy_timer
hrtimer_run_softirq
Allocated by task 166:
usb_alloc_coherent
snd_usb_endpoint_set_params
The buggy address is located 0 bytes to the right of
allocated 64-byte region [ffff000018617180, ffff0000186171c0)

Compute buffer_size after the delimiter packet has been accounted for,
and bound the fill loop by buffer_size, as prepare_silent_urb() already
does on the outbound side. This grows every Type II URB allocation by
one maxsize packet.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Published: 2026-08-22

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An out‑of‑bounds write occurs in the ALSA usb‑audio subsystem when a USB device advertises a Type II capture format. The kernel mis‑calculates the transfer buffer size by one packet, causing a descriptor that points beyond the allocated memory. This can corrupt arbitrary kernel memory during normal audio data transfer, leading to crashes or a potential privilege escalation if an attacker can influence the data flow.

Affected Systems

Any Linux kernel instance that loads the ALSA usb‑audio driver and interacts with a USB audio device offering a Type II capture format is affected. The issue exists until the kernel is patched to compute the buffer size after accounting for the transfer delimiter packet.

Risk and Exploitability

The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, but the CVSS score is 7.0. The likely attack vector is a physical or logical attacker who can connect a malicious USB audio device that presents a Type II capture format. An attacker triggering normal capture or playback operations could induce the overflow, potentially allowing arbitrary kernel writes. Exploitation requires access to the USB host controller, so the threat is moderate for systems that process USB audio streams.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8fdff6a319e7dac757c558bd283dc4577e68cde7`	affected	< 6af5f29af7711233ae68d3b25c15d67478468900
`8fdff6a319e7dac757c558bd283dc4577e68cde7`	affected	< f1fbb50b99311b35c2e85cc70341d62082dca4b5
`8fdff6a319e7dac757c558bd283dc4577e68cde7`	affected	< 137bf034740e5a2734794908d0aff1e0bd7cee6e
`8fdff6a319e7dac757c558bd283dc4577e68cde7`	affected	< 6607f85242577f33d4540a0d1f4a6137f5367058
`8fdff6a319e7dac757c558bd283dc4577e68cde7`	affected	< ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a
`8fdff6a319e7dac757c558bd283dc4577e68cde7`	affected	< 0a235379825e1a6194e43861ee6658e5fc35686d
`8fdff6a319e7dac757c558bd283dc4577e68cde7`	affected	< d3ed4e6321bb453757044cb9e5ecb30a33f04903
`8fdff6a319e7dac757c558bd283dc4577e68cde7`	affected	< 69ee44e1a23be62318189dc4b37fa4ad94053269

Linux

affected

Version	Status	Constraints
`3.5`	affected	—
`0`	unaffected	< 3.5
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8fdff6a319e7dac757c558bd283dc4577e68cde7,6af5f29af7711233ae68d3b25c15d67478468900)`	affected	code_commit	—
`[8fdff6a319e7dac757c558bd283dc4577e68cde7,f1fbb50b99311b35c2e85cc70341d62082dca4b5)`	affected	code_commit	—
`[8fdff6a319e7dac757c558bd283dc4577e68cde7,137bf034740e5a2734794908d0aff1e0bd7cee6e)`	affected	code_commit	—
`[8fdff6a319e7dac757c558bd283dc4577e68cde7,6607f85242577f33d4540a0d1f4a6137f5367058)`	affected	code_commit	—
`[8fdff6a319e7dac757c558bd283dc4577e68cde7,ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a)`	affected	code_commit	—
`[8fdff6a319e7dac757c558bd283dc4577e68cde7,0a235379825e1a6194e43861ee6658e5fc35686d)`	affected	code_commit	—
`[8fdff6a319e7dac757c558bd283dc4577e68cde7,d3ed4e6321bb453757044cb9e5ecb30a33f04903)`	affected	code_commit	—
`[8fdff6a319e7dac757c558bd283dc4577e68cde7,69ee44e1a23be62318189dc4b37fa4ad94053269)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.5`	affected	generic	—
`[0,3.5)`	unaffected	generic	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the ALSA usb‑audio out‑of‑bounds write fix.
Reboot the system so the patched driver loads.
If an update is not yet available, disable USB audio capture drivers using udev rules or modprobe -r snd_usb to block access to capture devices.

Generated by OpenCVE AI on August 25, 2026 at 17:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d
https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e
https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058
https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269
https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900
https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a
https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903
https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5
https://lore.kernel.org/linux-cve-announce/2026082232-CVE-2026-74682-dc58@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74682
https://www.cve.org/CVERecord?id=CVE-2026-74682

History

Tue, 25 Aug 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Tue, 25 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026082232-CVE-2026-74682-dc58@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74682 https://www.cve.org/CVERecord?id=CVE-2026-74682
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 22 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u->packets = urb_packs; u->buffer_size = maxsize * u->packets; if (fmt->fmt_type == UAC_FORMAT_TYPE_II) u->packets++; /* for transfer delimiter */ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL); buffer_size is computed from the pre-increment packet count and never recomputed, so for a Type II endpoint the buffer is one packet short of the packet count the URB is built with. prepare_inbound_urb() then lays out one iso frame per packet and never consults buffer_size: offs = 0; for (i = 0; i < urb_ctx->packets; i++) { urb->iso_frame_desc[i].offset = offs; urb->iso_frame_desc[i].length = ep->curpacksize; offs += ep->curpacksize; } urb->transfer_buffer_length = offs; urb->number_of_packets = urb_ctx->packets; The last descriptor therefore points one packet past the end of the transfer buffer, where the host controller writes device data on every inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound their fill loops by ctx->buffer_size, so only capture is affected. fmt_type comes from the device's audio streaming descriptors, so any device advertising a Type II capture format hits this once userspace sets hw_params on the stream. KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report per inbound transfer: BUG: KASAN: slab-out-of-bounds in dummy_timer Write of size 64 at addr ffff0000186171c0 by task cons02/166 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 166: usb_alloc_coherent snd_usb_endpoint_set_params The buggy address is located 0 bytes to the right of allocated 64-byte region [ffff000018617180, ffff0000186171c0) Compute buffer_size after the delimiter packet has been accounted for, and bound the fill loop by buffer_size, as prepare_silent_urb() already does on the outbound side. This grows every Type II URB allocation by one maxsize packet. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Title		ALSA: usb-audio: fix OOB write on Type II inbound URBs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058 https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269 https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900 https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903 https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:49.527Z

Updated: 2026-08-22T15:32:49.527Z

Reserved: 2026-08-15T05:44:03.925Z

Link: CVE-2026-74682

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:42.480

Modified: 2026-08-22T16:16:42.480

Link: CVE-2026-74682

Redhat

Severity : Moderate

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74682 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-25T18:00:15Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object