CVE-2026-74497: ALSA: usb-audio: Clamp frame size in implicit-feedback mode
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
sndusbhandlesyncurb() scales received sync packet sizes by the sender's stride and stores the result directly in outpacket->packetsize[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize.
The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits.
Cap the calculated frame count against ep->maxframesize in sndusbhandlesyncurb() to prevent oversized packets from entering the playback queue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74497?
CVE-2026-74497 has been assigned a risk rating of 33, indicating a moderate severity level due to the potential impact on USB audio devices.
How do I fix CVE-2026-74497?
To mitigate CVE-2026-74497, ensure that your Linux kernel is updated to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-74497?
CVE-2026-74497 affects systems running the Linux kernel with ALSA usb-audio functionality.
What is the nature of CVE-2026-74497?
CVE-2026-74497 involves a vulnerability in how the Linux kernel's ALSA handles frame sizes in implicit-feedback mode for USB audio devices.
When was CVE-2026-74497 published?
CVE-2026-74497 was published on August 15, 2026.