SB20260928272 - Out-of-bounds read in Linux kernel usb usx2y
Published: September 28, 2026 Updated: September 30, 2026
Security Bulletin ID
SB20260928272
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Physical access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2026-97930)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to read memory beyond the source buffer.
The vulnerability exists due to an out-of-bounds read in the ALSA usbusx2y driver when handling USB interrupt data during initialization. An attacker with physical access can trigger the initialization path to read three bytes past the end of the in04_buf allocation.
Remediation
Install update from vendor's website.