CVE-2026-97929: ALSA: usbusx2y: validate URB actual_length in interrupt callback
ALSA: usbusx2y: validate URB actuallength in interrupt callback
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ALSA usbusx2y, allocate in04_buf with kzalloc() to zero-initialize it, and in i_usx2y_in04_int() validate urb->actual_length; skip processing short transfers while still resubmitting the URB.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The affected interrupt callback must receive a short USB transfer from a malfunctioning device. Without an actual_length check, the driver can process uninitialized bytes remaining in its kmalloc-allocated interrupt buffer.
What data could be exposed through the flaw?
Uninitialized heap data in the in04_buf buffer can be copied into the mmap-accessible ctl_snapshot[] array. This makes the issue relevant where users can access that mapped control snapshot data.
What should be done if a short transfer is encountered?
The corrected behavior skips processing data from short transfers while continuing to resubmit the interrupt URB. The fix also zero-initializes the interrupt buffer with kzalloc().
How can I determine whether a kernel includes the fix?
Check whether the kernel source contains the usbusx2y interrupt-handler change that validates urb->actual_length in i_usx2y_in04_int(), skips short transfers, and uses kzalloc() for in04_buf. The provided stable references identify commits containing the correction.