CVE-2026-98836: ALSA: line6: reject oversized playback packets

In the Linux kernel, the following vulnerability has been resolved:

ALSA: line6: reject oversized playback packets

Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice is never compared against it.

submitaudioouturb() takes the frame count from prevfsize, which audioincallback() derived from the IN endpoint's received packet length, and rescales it with the playback frame size; when prevfsize is still zero it synthesizes a length from the sample rate instead. On a device declaring a large IN wMaxPacketSize and a small OUT wMaxPacketSize, the resulting memcpy(), or the memset() when the playback stream is idle, runs past its slice and, as the reproducer below shows, beyond the allocation.

usbsubmiturb() is not a backstop. maxpacketsizeout comes from usbmaxpacket(), which returns only the low 11 bits of wMaxPacketSize, while USB core validates a high-speed isochronous length against that base scaled by usbendpointmaxpmult(). A length of up to three times the allocated slice is therefore accepted, and even a rejected URB is only rejected after the write.

Reject a packet that does not fit the slice the driver allocated for it. Clamping it instead would silently shorten the capture-derived rate feedback and desynchronize the two streams.

BUG: KASAN: slab-out-of-bounds in submitaudioouturb (sound/usb/line6/playback.c:229) Write of size 1024 at addr ffff888100bbd400 by task kworker/1:2/5002 Workqueue: events line6startupwork Call Trace: asanmemcpy (mm/kasan/shadow.c:106) submitaudioouturb (sound/usb/line6/playback.c:229) line6submitaudiooutallurbs (sound/usb/line6/playback.c:291) line6streamstart (sound/usb/line6/pcm.c:194) line6pcmacquire (sound/usb/line6/pcm.c:337) line6startupwork (sound/usb/line6/driver.c:728) processonework (kernel/workqueue.c:3396) workerthread (kernel/workqueue.c:3479 kernel/workqueue.c:3560) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245)

The buggy address belongs to the object at ffff888100bbd400 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes inside of allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)