CVE-2026-74682: ALSA: usb-audio: fix OOB write on Type II inbound URBs
Published Aug 22, 2026
·Updated
ALSA: usb-audio: fix OOB write on Type II inbound URBs
Affected Software
2 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.150.1-1<6.6.152.1-1
6.6.152.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Aug 22, 2026
CVE Published
via MITRE·03:32 PM
Data Sourced
via MITRE·03:32 PM
Description
Data Sourced
via NVD·04:16 PM
Description
Aug 24, 2026
Data Sourced
via Microsoft·08:09 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:09 AM
Affected Software
Updated
via Microsoft·08:09 AM
DescriptionSeverity
Frequently Asked Questions
1
What hardware interaction is required for this issue to occur?
The affected path is used for inbound USB audio transfers on a Format Type II endpoint. During each such inbound transfer, the host controller writes device data into the URB transfer buffer, and the final frame descriptor can address one packet beyond that buffer.
2
Are the silent-URB and playback-URB paths affected in the same way?
No. The available description states that prepare_silent_urb() and prepare_playback_urb() bound their fill loops by ctx->buffer_size, unlike the affected inbound preparation path.