CVE-2026-93808: ALSA: usb-audio: caiaq: validate EP1 reply lengths
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: caiaq: validate EP1 reply lengths
usbep1commandreplydispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actuallength contains those bytes.
Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add per-command length checks for caiaq USB-audio EP1 replies, deriving the payload length from urb->actual_length and rejecting short replies before usb_ep1_command_reply_dispatch() or input helpers read fixed offsets such as buf + 1, buf[1], buf[2], or buf + 3.
Event History
Frequently Asked Questions
What condition is required to trigger the vulnerable code paths?
The caiaq USB-audio driver's EP1 reply dispatcher must receive a reply whose actual URB length is shorter than the command-specific data the driver expects. The vulnerable paths then access fixed offsets after the command byte without first confirming those bytes are present.
Which reply types were specifically addressed by the fix?
The fix adds per-command reply-length validation, derives the control-state copy length from bytes following the command byte, and rejects short analog-input payloads before the input helper accesses fixed offsets.