CVE-2026-98769: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fuac1legacy: validate bRequest index in generic{set,get}cmd
genericsetcmd() and genericgetcmd() use the low nibble of ctrl->bRequest as an index into con->data[]:
u8 cmd = (ctrl->bRequest & 0x0F); / 0 .. 15 / ... con->data[cmd] = value; / OOB when cmd >= 5 /
struct usbaudiocontrol (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap.
A malicious USB host can craft a class-specific SETCUR / GETCUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions.
Add an ARRAYSIZE() guard to both functions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Add an ARRAY_SIZE() guard to both generic_set_cmd() and generic_get_cmd() so the low-nibble bRequest index cannot access beyond the 5-element con->data[] array.
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious USB host can exploit it against a device running the affected USB Audio Class 1 legacy gadget function. The attacker needs to be able to send crafted class-specific USB control requests to that gadget.
Does exploitation require authentication or additional device-side setup?
No further preconditions are described. A crafted SET_CUR or GET_CUR request with an arbitrary bRequest value can trigger the out-of-bounds access from an IRQ completion handler.
What is the impact of the malformed request?
The low nibble of bRequest can select indices 5 through 15 even though the control data array has only five elements. This can read from or write up to 44 bytes beyond the heap-allocated array.
What mitigation is indicated when patching is not immediately possible?
The provided information identifies exposure specifically through the USB Audio Class 1 legacy gadget function and requests from a USB host. Limiting untrusted USB hosts' ability to communicate with that gadget function reduces the described attack path.