CVE-2026-98836: ALSA: line6: reject oversized playback packets
ALSA: line6: reject oversized playback packets
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the ALSA line6 playback driver, reject any playback packet whose length exceeds the allocated out.buffer slice before performing memcpy() or memset(); do not rely on usb_submit_urb() to catch the overflow.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the ALSA line6 driver for playback are exposed when a connected device declares a large IN endpoint maximum packet size and a smaller OUT endpoint maximum packet size. The playback buffer slice is sized using the OUT endpoint, while the amount written can be derived from received data on the IN endpoint.
Does an attacker need to actively stream playback audio to trigger the overwrite?
No. The description states that, when the playback stream is idle, the driver can use memset() with the oversized calculated length, which can also run beyond the allocated slice.
Can USB core validation prevent the out-of-bounds access?
No. usb_submit_urb() is not a backstop in this case: high-speed isochronous lengths can be accepted at up to three times the allocated slice because allocation uses only the low 11 bits of wMaxPacketSize while USB core validation accounts for the endpoint multiplier.