SB20261007105 - Out-of-bounds write in Linux kernel usb

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-98265)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in the ALSA USB audio driver's implicit feedback handling when processing a capture endpoint packet count that exceeds the playback URB's allocated descriptor capacity. A local user can supply a USB audio device with mismatched implicit feedback capture and playback endpoint parameters to corrupt kernel memory.

The reproducer uses a high-speed UAC2 device declaring bInterval 1 for capture and bInterval 4 for playback. The invalid writes occur on the first capture completion after the audio stream starts.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/76a986c980bb502c7688d605ac7a67fd257a9a1b
• https://git.kernel.org/stable/c/79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a
• https://git.kernel.org/stable/c/ab77e3f453c5f2499c08d6e8e218501d25bab39e
• https://git.kernel.org/stable/c/ad279ba0dc1781229f5b52f58d38d56960400e06