CVE-2026-97929: ALSA: usbusx2y: validate URB actual_length in interrupt callback
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usbusx2y: validate URB actuallength in interrupt callback
iusx2yin04int() processes the interrupt URB data without checking urb->actuallength. A short transfer from a malfunctioning device would cause the handler to process uninitialized heap data from the kmalloc-allocated in04buf, which is then copied to the mmap-accessible ctlsnapshot[] array.
Fix by using kzalloc() for in04buf to zero-initialize the buffer, and adding an actuallength check to skip processing on short transfers while still resubmitting the URB.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the ALSA usbusx2y driver, allocate in04_buf with kzalloc() to zero-initialize it, and validate urb->actual_length in i_usx2y_in04_int() so short transfers are skipped before processing ctl_snapshot[] data.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The affected interrupt callback must receive a short USB transfer from a malfunctioning device. Without an actual_length check, the driver can process uninitialized bytes remaining in its kmalloc-allocated interrupt buffer.
What data could be exposed through the flaw?
Uninitialized heap data in the in04_buf buffer can be copied into the mmap-accessible ctl_snapshot[] array. This makes the issue relevant where users can access that mapped control snapshot data.
What should be done if a short transfer is encountered?
The corrected behavior skips processing data from short transfers while continuing to resubmit the interrupt URB. The fix also zero-initializes the interrupt buffer with kzalloc().
How can I determine whether a kernel includes the fix?
Check whether the kernel source contains the usbusx2y interrupt-handler change that validates urb->actual_length in i_usx2y_in04_int(), skips short transfers, and uses kzalloc() for in04_buf. The provided stable references identify commits containing the correction.