UBUNTU-CVE-2026-98769: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate bRequest index in generic{set,get}cmd genericsetcmd() and genericgetcmd() use the low nibble of ctrl->bRequest as an index into con->data[]: u8 cmd = (ctrl->bRequest & 0x0F); / 0 .. 15 / ... con->data[cmd] = value; / OOB when cmd >= 5 / struct usbaudiocontrol (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap. A malicious USB host can craft a class-specific SETCUR / GETCUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions. Add an ARRAYSIZE() guard to both functions.