SB20261022347 - Heap-based buffer overflow in Linux kernel usb misc

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-98741)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to corrupt kernel heap memory and cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the Linux kernel ALSA ua101 USB audio driver when calculating playback write sizes from capture packets without validating the relative endpoint packet sizes and channel counts. An attacker with physical access to system can connect a USB device advertising crafted capture and playback descriptors and induce a user to open its playback PCM node to trigger writes beyond the allocated playback buffer, corrupting kernel memory and causing a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4294fe57048594a9e158b61c967bb7f943cda477
• https://git.kernel.org/stable/c/86f86e6fdedc33c5b8d38b9208b350f8accf57ee
• https://git.kernel.org/stable/c/ada5ded765f059a6e3036e69ca350449442af0fc
• https://git.kernel.org/stable/c/eb0c7fda59cf650076f8ed5b949a6c8441aa3606
• https://git.kernel.org/stable/c/fd3a7bf0d988b0878a1957df150edb35f81db87e