CVE-2026-98741: ALSA: ua101: reject mismatched capture/playback packet sizes
ALSA: ua101: reject mismatched capture/playback packet sizes
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems are exposed when the Linux kernel's ALSA ua101 driver probes a USB audio device that advertises mismatched capture and playback packet sizes and channel counts. Genuine UA-101 and UA-1000 hardware declares proportional packet sizes and is unaffected.
What does an attacker need to exploit the vulnerability?
An attacker needs to present a crafted USB audio device or descriptor to a system using the ua101 driver. The malformed device must advertise a large capture wMaxPacketSize with few capture channels and a small playback wMaxPacketSize with many playback channels.
When does the out-of-bounds write occur?
The overwrite occurs when the PCM node registered during device probe is opened. Playback buffer writes are sized using capture-derived frame counts, which can exceed the allocated playback buffer size before usb_submit_urb() rejects the oversized transfer with -EMSGSIZE.
How can I tell whether a connected device is affected?
The affected condition is a mismatch between capture and playback endpoint packet sizes relative to their channel counts. Devices whose capture and playback packet sizes are proportional, including genuine UA-101 and UA-1000 hardware, are not affected.