CVE-2026-31778

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31778", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.140Z", "datePublished": "2026-05-01T14:15:05.804Z", "dateUpdated": "2026-11-06T15:32:25.311Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:15:37.687Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len < sizeof(card->id)` is used for the bounds check. Since\nsizeof(card->id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -> copy_valid_id_string(), the function scans\nforward with `while (*nid && ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n sound/core/init.c:696 [inline]\n BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card->id) - 1`,\nensuring at least one byte remains as the null terminator."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/device.c"], "versions": [{"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "02d9c5b0b5553a391448b6d655262bd829f90234", "status": "affected", "versionType": "git"}, {"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6", "status": "affected", "versionType": "git"}, {"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "66194c2575a4f567577ae70b1d7561163ce791a6", "status": "affected", "versionType": "git"}, {"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "a82c1bce2d1299dd3c686a8fe48cf75b79a403c7", "status": "affected", "versionType": "git"}, {"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "3178b62e2e31bab39f63d4c8e54bf4ee0a425627", "status": "affected", "versionType": "git"}, {"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "3afa2e67f3523a980a2f90fd63c22322ac2b9ce0", "status": "affected", "versionType": "git"}, {"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "7594a6464873d90fd229e5b94cdd3b92c9feabed", "status": "affected", "versionType": "git"}, {"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "45424e871abf2a152e247a9cff78359f18dd95c0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/device.c"], "versions": [{"version": "2.6.31", "status": "affected"}, {"version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234"}, {"url": "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6"}, {"url": "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6"}, {"url": "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7"}, {"url": "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627"}, {"url": "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0"}, {"url": "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed"}, {"url": "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0"}], "title": "ALSA: caiaq: fix stack out-of-bounds read in init_card", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31778", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:25:25.500479Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:32:25.311Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31778", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:25:25.500479Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:25:26.585Z"}}], "cna": {"title": "ALSA: caiaq: fix stack out-of-bounds read in init_card", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "02d9c5b0b5553a391448b6d655262bd829f90234", "versionType": "git"}, {"status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6", "versionType": "git"}, {"status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "66194c2575a4f567577ae70b1d7561163ce791a6", "versionType": "git"}, {"status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "a82c1bce2d1299dd3c686a8fe48cf75b79a403c7", "versionType": "git"}, {"status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "3178b62e2e31bab39f63d4c8e54bf4ee0a425627", "versionType": "git"}, {"status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "3afa2e67f3523a980a2f90fd63c22322ac2b9ce0", "versionType": "git"}, {"status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "7594a6464873d90fd229e5b94cdd3b92c9feabed", "versionType": "git"}, {"status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "lessThan": "45424e871abf2a152e247a9cff78359f18dd95c0", "versionType": "git"}], "programFiles": ["sound/usb/caiaq/device.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.31", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.134", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.81", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/usb/caiaq/device.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234"}, {"url": "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6"}, {"url": "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6"}, {"url": "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7"}, {"url": "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627"}, {"url": "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0"}, {"url": "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed"}, {"url": "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len < sizeof(card->id)` is used for the bounds check. Since\nsizeof(card->id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -> copy_valid_id_string(), the function scans\nforward with `while (*nid && ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n sound/core/init.c:696 [inline]\n BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card->id) - 1`,\nensuring at least one byte remains as the null terminator."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.134", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.81", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.22", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.12", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "2.6.31"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:15:37.687Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31778", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:32:25.311Z", "dateReserved": "2026-03-09T15:48:24.140Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-01T14:15:05.804Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/caiaq/device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "02d9c5b0b5553a391448b6d655262bd829f90234", "status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "versionType": "git"}, {"lessThan": "3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6", "status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "versionType": "git"}, {"lessThan": "66194c2575a4f567577ae70b1d7561163ce791a6", "status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "versionType": "git"}, {"lessThan": "a82c1bce2d1299dd3c686a8fe48cf75b79a403c7", "status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "versionType": "git"}, {"lessThan": "3178b62e2e31bab39f63d4c8e54bf4ee0a425627", "status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "versionType": "git"}, {"lessThan": "3afa2e67f3523a980a2f90fd63c22322ac2b9ce0", "status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "versionType": "git"}, {"lessThan": "7594a6464873d90fd229e5b94cdd3b92c9feabed", "status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "versionType": "git"}, {"lessThan": "45424e871abf2a152e247a9cff78359f18dd95c0", "status": "affected", "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/caiaq/device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"lessThan": "2.6.31", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B50E0851-B870-41D9-8E6F-BA8182EF6CCB", "versionEndExcluding": "5.10.253", "versionStartIncluding": "2.6.31", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len < sizeof(card->id)` is used for the bounds check. Since\nsizeof(card->id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -> copy_valid_id_string(), the function scans\nforward with `while (*nid && ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n sound/core/init.c:696 [inline]\n BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card->id) - 1`,\nensuring at least one byte remains as the null terminator."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: caiaq: correcci\u00f3n de lectura fuera de l\u00edmites de la pila en init_card\n\nEl bucle crea una copia del nombre corto de la tarjeta sin espacios en blanco donde se utiliza \u2019len < sizeof(card -> id)\u2019 para la comprobaci\u00f3n de l\u00edmites. Dado que sizeof(card -> id) es 16 y el b\u00fafer de ID local tambi\u00e9n es de 16 bytes, escribir 16 caracteres que no son espacios llena todo el b\u00fafer, sobrescribiendo el byte nulo de terminaci\u00f3n.\n\nCuando esta cadena no terminada en nulo se pasa m\u00e1s tarde a snd_card_set_id() -> copy_valid_id_string(), la funci\u00f3n escanea hacia adelante con \u2019while (nid && ...)\u2019 y lee m\u00e1s all\u00e1 del final del b\u00fafer de la pila, leyendo el contenido de la pila.\n\nUn dispositivo USB con un nombre de producto que contenga muchos caracteres no ASCII y no espaciales (por ejemplo, UTF-8 multibyte) activar\u00e1 esto de forma fiable de la siguiente manera:\n\n BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n sound/core/init.c:696 [inline]\n BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n sound/core/init.c:718\n\nEl error de uno ha estado presente desde el commit bafeee5b1f8d (\u2019ALSA: snd_usb_caiaq: give better shortname\u2019) de junio de 2009 (v2.6.31-rc1), que introdujo por primera vez este bucle de eliminaci\u00f3n de espacios en blanco. El c\u00f3digo original nunca tuvo en cuenta el terminador nulo al limitar la copia.\n\nSolucione esto cambiando el l\u00edmite del bucle a \u2019sizeof(card -> id) - 1\u2019, asegurando que al menos un byte permanezca como el terminador nulo."}], "id": "CVE-2026-31778", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31778", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:25:25.500479Z", "version": "2.0.3"}}]}, "published": "2026-05-01T15:16:41.190", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ALSA: caiaq: fix stack out-of-bounds read in init_card", "id": "2464356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464356"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-170", "details": ["A flaw was found in the Linux kernel's ALSA caiaq driver. A local user with a specially crafted USB device, containing a product name with many non-ASCII or non-space characters, can trigger a stack out-of-bounds read. This vulnerability allows the system to read past the end of a stack buffer, potentially leading to information disclosure from the kernel stack."], "name": "CVE-2026-31778", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31778\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31778\nhttps://lore.kernel.org/linux-cve-announce/2026050150-CVE-2026-31778-5ddb@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a,02d9c5b0b5553a391448b6d655262bd829f90234)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a,3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a,66194c2575a4f567577ae70b1d7561163ce791a6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a,a82c1bce2d1299dd3c686a8fe48cf75b79a403c7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a,3178b62e2e31bab39f63d4c8e54bf4ee0a425627)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a,3afa2e67f3523a980a2f90fd63c22322ac2b9ce0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a,7594a6464873d90fd229e5b94cdd3b92c9feabed)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a,45424e871abf2a152e247a9cff78359f18dd95c0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.31"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.31)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.168,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.134,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T19:00:08.008908+00:00", "updated": "2026-05-11T23:30:02.974973+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}