Out-of-bounds write in Linux kernel - CVE-2026-98312

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in usb6fire_pcm_in_urb_handler() in the ALSA 6fire driver when calculating outgoing isochronous packet sizes from device-reported input lengths. A local user can supply isochronous packets whose reported lengths cause output buffer writes to exceed the allocated buffer to cause a denial of service.

Zero-length isochronous packets are legal on the USB bus. At 88.2/96 kHz, eight full 420-byte input packets can produce 5024 bytes of output for a 4832-byte buffer.

Affected software

How to mitigate CVE-2026-98312

External References

• https://git.kernel.org/stable/c/001ba7c1d9677225a5ecbc3e60d4865c08bb21d8
• https://git.kernel.org/stable/c/1589afe2d099d3e817873bc474676968d7080410
• https://git.kernel.org/stable/c/246de677552fe5dede293a1543b632e9853f31e4
• https://git.kernel.org/stable/c/61e665fb48e9eee44ec6d610514af383b1802cc1
• https://git.kernel.org/stable/c/cdc31537012bc7a58c95c6750db321b69dd802bb
• https://git.kernel.org/stable/c/ea11ade10583cc45af515d6b24510dbfa0184ca6

Related Security Bulletins

• Out-of-bounds write in Linux kernel usb 6fire
• Debian update for linux