CVE-2026-97930: ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usbusx2y: fix in04last array size mismatch with in04buf
The in04last array in struct usx2ydev is declared as char[24], but in04buf is allocated as sizeof(struct us428ctls) which is 21 bytes. In iusx2yin04int(), when ctlsnapshotlast == -2 (initialization path):
memcpy(usx2y->in04last, usx2y->in04buf, sizeof(usx2y->in04last));
This copies 24 bytes from a 21-byte slab allocation, reading 3 bytes past the end of the source object.
Introduce a USX2YIN04SIZE constant defined as sizeof(struct us428ctls) and use it consistently for the in04last array, the in04buf allocation, the URB transfer length, and the comparison loop, replacing the bare 24 and 21 literals throughout.
Affected Software
Event History
Frequently Asked Questions
What hardware or kernel path must be in use for this issue to be relevant?
The affected code is in the ALSA usbusx2y driver. The out-of-bounds read occurs in the driver's in04 interrupt handling path during initialization, when ctl_snapshot_last is -2.
What condition triggers the out-of-bounds read?
During the initialization path, the driver copies 24 bytes from in04_buf into in04_last even though in04_buf is allocated at 21 bytes, the size of struct us428_ctls. This reads 3 bytes beyond the source allocation.
How can I determine whether a fix is present?
Check whether the usbusx2y driver defines and consistently uses USX2Y_IN04_SIZE, based on sizeof(struct us428_ctls), for in04_last, in04_buf allocation, URB transfer length, and the comparison loop. The provided stable references identify commits containing the correction.