CVE-2026-74498: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fillmax is set
When a USB audio endpoint requests full packet transfers via the fillmax descriptor flag, dataepsetparams() promotes ep->curpacksize to ep->maxpacksize. However, maxsize is left at the original sample-rate derived value.
Since u->buffersize is allocated as maxsize packets, the resulting DMA buffer is far too small for the requested transfer length. When the USB host controller streams up to curpacksize bytes per packet, it writes past the end of the buffer via DMA, corrupting kernel heap memory.
Update maxsize to curpacksize when fillmax is set so that the allocated DMA buffer size matches the actual transfer request size.
[ changed to reassign maxsize only when ep->fillmax is set -- tiwai ]
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74498?
CVE-2026-74498 has a risk score of 62, indicating a medium to high severity level.
How do I fix CVE-2026-74498?
To fix CVE-2026-74498, upgrade your Linux kernel to a version that contains the appropriate patch for the vulnerability.
What systems are affected by CVE-2026-74498?
CVE-2026-74498 affects the Linux kernel when handling USB audio endpoints.
What is the impact of CVE-2026-74498?
The impact of CVE-2026-74498 is an out-of-bounds write which could lead to data corruption or system instability.
When was CVE-2026-74498 published?
CVE-2026-74498 was published on August 15, 2026.