CVE-2026-98265: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.8-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the ALSA USB-audio implementation, fold the Format Type II delimiter into urb_packs before the allocation loop, record the allocated packet count per endpoint, and clamp both the adopted packet count and the packet-size copy to that recorded limit so prepare_playback_urb() and prepare_silent_urb() cannot index iso_frame_desc[] beyond the URB allocation.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel USB-audio driver with an implicit-feedback sink are exposed when the feedback capture endpoint reports more isochronous packets than the playback endpoint's URB allocation supports. The documented reproducer is a high-speed UAC2 device with bInterval 1 on implicit-feedback capture and bInterval 4 on playback.
What is required to trigger the out-of-bounds access?
A USB audio stream must start with endpoint parameters that cause the sync source packet count to exceed the data URB packet capacity. On the first capture completion, the driver can then access iso_frame_desc entries beyond the allocated URB descriptor array.
How might this appear during testing or diagnostics?
The reported reproducer produces a KASAN slab-out-of-bounds report in prepare_playback_urb(), with a write past the one-packet URB's descriptor allocation. The description also identifies prepare_silent_urb() as another path that can write beyond the descriptor index limit.