Out-of-bounds write in Linux kernel - CVE-2026-98265
Published: October 7, 2026
Vulnerability identifier: #VU153760
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98265
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to an out-of-bounds write in the ALSA USB audio driver's implicit feedback handling when processing a capture endpoint packet count that exceeds the playback URB's allocated descriptor capacity. A local user can supply a USB audio device with mismatched implicit feedback capture and playback endpoint parameters to corrupt kernel memory.
The reproducer uses a high-speed UAC2 device declaring bInterval 1 for capture and bInterval 4 for playback. The invalid writes occur on the first capture completion after the audio stream starts.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98265
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1