Out-of-bounds read in Linux kernel - CVE-2026-97930

Vulnerability details

The vulnerability allows an attacker with physical access to read memory beyond the source buffer.

The vulnerability exists due to an out-of-bounds read in the ALSA usbusx2y driver when handling USB interrupt data during initialization. An attacker with physical access can trigger the initialization path to read three bytes past the end of the in04_buf allocation.

Affected software

How to mitigate CVE-2026-97930

External References

• https://git.kernel.org/stable/c/229cab526580f82839ae8e4e379753c8cf16952e
• https://git.kernel.org/stable/c/381495b5b3da12d714e53d9d12d955b13fe26eac
• https://git.kernel.org/stable/c/861111a14740e12c36d363e9830f8daa734279c9
• https://git.kernel.org/stable/c/b5753bdfd909f7f095fb464d67802b5e52cbadbf

Related Security Bulletins

• Out-of-bounds read in Linux kernel usb usx2y