CVE-2026-98265ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity data_ep_set_params() allocates each data URB for exactly u->packets isochronous frames, so urb->iso_frame_desc[] has u->packets slots and ctx->packets is the driver's only record of that limit. For an implicit feedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the sync source's packet count, which is calculated independently from the capture endpoint's parameters. When that count is larger, prepare_playback_urb() and prepare_silent_urb() can write iso_frame_desc[] past the allocation; their existing bounds limit payload bytes, not the descriptor index. The reproducer uses a high-speed UAC2 device declaring bInterval 1 for implicit feedback capture (8 packets) and bInterval 4 for playback (1 packet). On the first capture completion after the stream starts, it accesses seven descriptors spanning 112 bytes beyond the one-packet URB: BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560) Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178 prepare_playback_urb (sound/usb/pcm.c:1560) prepare_outbound_urb (sound/usb/endpoint.c:340) snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501) snd_complete_urb (sound/usb/endpoint.c:1834) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741) vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107) kthread (kernel/kthread.c:436) The buggy address belongs to the object at ffff88801e696a00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0) Record the allocated packet count per endpoint and clamp both the adopted count and the packet-size copy to it. Fold the Format Type II delimiter into urb_packs before the allocation loop so the recorded limit matches every URB.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 24 days later
· 24 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.17% · top 93% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected df75696e70c88b22ed1d8c9d515993a858c58fd0 – < 6c5c986f761756a6ff7b3aea51c11994fc2464e5
- affected 3a74f6b46c01d9a816378cd83c327a59f61475ec – < e44cee1bf51e606f3e70a213eb5a1abb3fa56a81
- affected c26bde6301f20d9aafbfb7c2459a88c6a6ec178f – < 8b637ab10e40e01b452f4aff66dad335a9b89a16
- affected 32a1f64f8ff6e2c5391f5964baec697bce25b83c – < ad279ba0dc1781229f5b52f58d38d56960400e06
- affected e949fd266cfa1dcca7caa3faa698578c4ffd26d6 – < 79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a
- affected cf044e44190234a41a788de1cdbb6c21f4a52e1e – < ab77e3f453c5f2499c08d6e8e218501d25bab39e
- affected cf044e44190234a41a788de1cdbb6c21f4a52e1e – < 76a986c980bb502c7688d605ac7a67fd257a9a1b
- affected f6fbdf797e016fbf968dd54301026b182175985a
- affected 5.15.202 – < 5.15.224
- affected 6.1.165 – < 6.1.191
- affected 6.6.128 – < 6.6.160
- affected 6.12.75 – < 6.12.112
- affected 6.18.16 – < 6.18.54
- affected 6.19.6 – < 6.20
- affected 7.0
- unaffected < 7.0
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References7
- https://git.kernel.org/stable/c/6c5c986f761756a6ff7b3aea51c11994fc2464e5 (opens in a new tab)
- https://git.kernel.org/stable/c/e44cee1bf51e606f3e70a213eb5a1abb3fa56a81 (opens in a new tab)
- https://git.kernel.org/stable/c/8b637ab10e40e01b452f4aff66dad335a9b89a16 (opens in a new tab)
- https://git.kernel.org/stable/c/ad279ba0dc1781229f5b52f58d38d56960400e06 (opens in a new tab)
- https://git.kernel.org/stable/c/79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a (opens in a new tab)
- https://git.kernel.org/stable/c/ab77e3f453c5f2499c08d6e8e218501d25bab39e (opens in a new tab)
- https://git.kernel.org/stable/c/76a986c980bb502c7688d605ac7a67fd257a9a1b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-93193 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98265)Record last updated .