CVE-2026-43279

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43279", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.998Z", "datePublished": "2026-05-06T11:29:00.844Z", "dateUpdated": "2026-10-19T19:16:25.738Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:01.240Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Add sanity check for OOB writes at silencing\n\nAt silencing the playback URB packets in the implicit fb mode before\nthe actual playback, we blindly assume that the received packets fit\nwith the buffer size. But when the setup in the capture stream\ndiffers from the playback stream (e.g. due to the USB core limitation\nof max packet size), such an inconsistency may lead to OOB writes to\nthe buffer, resulting in a crash.\n\nFor addressing it, add a sanity check of the transfer buffer size at\nprepare_silent_urb(), and stop the data copy if the received data\noverflows. Also, report back the transfer error properly from there,\ntoo.\n\nNote that this doesn't fix the root cause of the playback error\nitself, but this merely covers the kernel Oops."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is exercised through local ALSA PCM device-file operations such as open, hw_params, prepare, and trigger/write on a USB audio PCM device. It is not network reachable, but a local user can drive the stream path once a susceptible USB audio device is present.\nAC:L - There is no race or hard-to-hit timing condition; the overflow follows deterministically when implicit-feedback packet sizes exceed the playback URB buffer. A malicious or affected device plus chosen stream parameters can repeatedly drive the bad packet-size path.\nPR:L - The ALSA PCM path does not require CAP_SYS_ADMIN or another kernel capability, only permission to access the relevant /dev/snd PCM node as a normal local audio user/session. User namespaces are not needed.\nUI:N - A local attacker with PCM device access can open, configure, and start the stream directly. No separate victim action is required for that local attack path.\nS:U - The corruption occurs within the host kernel USB audio/ALSA subsystem and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds write into kernel USB transfer-buffer memory, which is kernel memory corruption. Even though the reported symptom is an oops, such corruption can plausibly be leveraged for information disclosure.\nI:H - The vulnerable code writes past the allocated URB transfer buffer while preparing silent playback packets. Out-of-bounds kernel writes are high-integrity impact because they can corrupt adjacent kernel state and potentially enable control-flow or data modification.\nA:H - The commit explicitly describes resulting kernel oops/crash behavior, and the fix only bounds the write to prevent that crash. The trigger can be repeated by starting the affected stream again."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/endpoint.c"], "versions": [{"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f", "status": "affected", "versionType": "git"}, {"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "780dc57794a217b49994fa1d0b42465fb10a00aa", "status": "affected", "versionType": "git"}, {"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "8995fc0e00b3fee9bf7ecb3d836b635b730c1049", "status": "affected", "versionType": "git"}, {"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fc9e5af60dc199051dc202ae78e1fe76a9977a5e", "status": "affected", "versionType": "git"}, {"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "6af16f1b8649df4c00d6ced924bdd8b72c885b6a", "status": "affected", "versionType": "git"}, {"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "ccaf9296763be4f76b59e2cac377006016c34435", "status": "affected", "versionType": "git"}, {"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fba2105a157fffcf19825e4eea498346738c9948", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/endpoint.c"], "versions": [{"version": "3.5", "status": "affected"}, {"version": "0", "lessThan": "3.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.15.202"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.1.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.6.128"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f"}, {"url": "https://git.kernel.org/stable/c/780dc57794a217b49994fa1d0b42465fb10a00aa"}, {"url": "https://git.kernel.org/stable/c/8995fc0e00b3fee9bf7ecb3d836b635b730c1049"}, {"url": "https://git.kernel.org/stable/c/fc9e5af60dc199051dc202ae78e1fe76a9977a5e"}, {"url": "https://git.kernel.org/stable/c/6af16f1b8649df4c00d6ced924bdd8b72c885b6a"}, {"url": "https://git.kernel.org/stable/c/ccaf9296763be4f76b59e2cac377006016c34435"}, {"url": "https://git.kernel.org/stable/c/fba2105a157fffcf19825e4eea498346738c9948"}], "title": "ALSA: usb-audio: Add sanity check for OOB writes at silencing", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43279", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:16:13.763153Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:16:25.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43279", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:16:13.763153Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:16:14.297Z"}}], "cna": {"title": "ALSA: usb-audio: Add sanity check for OOB writes at silencing", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is exercised through local ALSA PCM device-file operations such as open, hw_params, prepare, and trigger/write on a USB audio PCM device. It is not network reachable, but a local user can drive the stream path once a susceptible USB audio device is present.\nAC:L - There is no race or hard-to-hit timing condition; the overflow follows deterministically when implicit-feedback packet sizes exceed the playback URB buffer. A malicious or affected device plus chosen stream parameters can repeatedly drive the bad packet-size path.\nPR:L - The ALSA PCM path does not require CAP_SYS_ADMIN or another kernel capability, only permission to access the relevant /dev/snd PCM node as a normal local audio user/session. User namespaces are not needed.\nUI:N - A local attacker with PCM device access can open, configure, and start the stream directly. No separate victim action is required for that local attack path.\nS:U - The corruption occurs within the host kernel USB audio/ALSA subsystem and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds write into kernel USB transfer-buffer memory, which is kernel memory corruption. Even though the reported symptom is an oops, such corruption can plausibly be leveraged for information disclosure.\nI:H - The vulnerable code writes past the allocated URB transfer buffer while preparing silent playback packets. Out-of-bounds kernel writes are high-integrity impact because they can corrupt adjacent kernel state and potentially enable control-flow or data modification.\nA:H - The commit explicitly describes resulting kernel oops/crash behavior, and the fix only bounds the write to prevent that crash. The trigger can be repeated by starting the affected stream again."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f", "versionType": "git"}, {"status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "780dc57794a217b49994fa1d0b42465fb10a00aa", "versionType": "git"}, {"status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "8995fc0e00b3fee9bf7ecb3d836b635b730c1049", "versionType": "git"}, {"status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fc9e5af60dc199051dc202ae78e1fe76a9977a5e", "versionType": "git"}, {"status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "6af16f1b8649df4c00d6ced924bdd8b72c885b6a", "versionType": "git"}, {"status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "ccaf9296763be4f76b59e2cac377006016c34435", "versionType": "git"}, {"status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fba2105a157fffcf19825e4eea498346738c9948", "versionType": "git"}], "programFiles": ["sound/usb/endpoint.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.5"}, {"status": "unaffected", "version": "0", "lessThan": "3.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.202", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.165", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.128", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/usb/endpoint.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f"}, {"url": "https://git.kernel.org/stable/c/780dc57794a217b49994fa1d0b42465fb10a00aa"}, {"url": "https://git.kernel.org/stable/c/8995fc0e00b3fee9bf7ecb3d836b635b730c1049"}, {"url": "https://git.kernel.org/stable/c/fc9e5af60dc199051dc202ae78e1fe76a9977a5e"}, {"url": "https://git.kernel.org/stable/c/6af16f1b8649df4c00d6ced924bdd8b72c885b6a"}, {"url": "https://git.kernel.org/stable/c/ccaf9296763be4f76b59e2cac377006016c34435"}, {"url": "https://git.kernel.org/stable/c/fba2105a157fffcf19825e4eea498346738c9948"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Add sanity check for OOB writes at silencing\n\nAt silencing the playback URB packets in the implicit fb mode before\nthe actual playback, we blindly assume that the received packets fit\nwith the buffer size. But when the setup in the capture stream\ndiffers from the playback stream (e.g. due to the USB core limitation\nof max packet size), such an inconsistency may lead to OOB writes to\nthe buffer, resulting in a crash.\n\nFor addressing it, add a sanity check of the transfer buffer size at\nprepare_silent_urb(), and stop the data copy if the received data\noverflows. Also, report back the transfer error properly from there,\ntoo.\n\nNote that this doesn't fix the root cause of the playback error\nitself, but this merely covers the kernel Oops."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.202", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.165", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.128", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.75", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.16", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.6", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "3.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:01.240Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43279", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:16:25.738Z", "dateReserved": "2026-05-01T14:12:55.998Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-06T11:29:00.844Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/endpoint.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f", "status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "versionType": "git"}, {"lessThan": "780dc57794a217b49994fa1d0b42465fb10a00aa", "status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "versionType": "git"}, {"lessThan": "8995fc0e00b3fee9bf7ecb3d836b635b730c1049", "status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "versionType": "git"}, {"lessThan": "fc9e5af60dc199051dc202ae78e1fe76a9977a5e", "status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "versionType": "git"}, {"lessThan": "6af16f1b8649df4c00d6ced924bdd8b72c885b6a", "status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "versionType": "git"}, {"lessThan": "ccaf9296763be4f76b59e2cac377006016c34435", "status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "versionType": "git"}, {"lessThan": "fba2105a157fffcf19825e4eea498346738c9948", "status": "affected", "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/endpoint.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.5"}, {"lessThan": "3.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.202", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.165", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.128", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B3CF65E-D072-49FD-A99C-0159B48E8075", "versionEndExcluding": "5.15.202", "versionStartIncluding": "3.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654", "versionEndExcluding": "6.1.165", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2", "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Add sanity check for OOB writes at silencing\n\nAt silencing the playback URB packets in the implicit fb mode before\nthe actual playback, we blindly assume that the received packets fit\nwith the buffer size. But when the setup in the capture stream\ndiffers from the playback stream (e.g. due to the USB core limitation\nof max packet size), such an inconsistency may lead to OOB writes to\nthe buffer, resulting in a crash.\n\nFor addressing it, add a sanity check of the transfer buffer size at\nprepare_silent_urb(), and stop the data copy if the received data\noverflows. Also, report back the transfer error properly from there,\ntoo.\n\nNote that this doesn't fix the root cause of the playback error\nitself, but this merely covers the kernel Oops."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: usb-audio: A\u00f1adir una comprobaci\u00f3n de cordura para escrituras fuera de l\u00edmites al silenciar\n\nAl silenciar los paquetes URB de reproducci\u00f3n en el modo fb impl\u00edcito antes de la reproducci\u00f3n real, asumimos ciegamente que los paquetes recibidos encajan con el tama\u00f1o del b\u00fafer. Pero cuando la configuraci\u00f3n en el flujo de captura difiere del flujo de reproducci\u00f3n (p. ej., debido a la limitaci\u00f3n del n\u00facleo USB del tama\u00f1o m\u00e1ximo de paquete), tal inconsistencia puede llevar a escrituras fuera de l\u00edmites en el b\u00fafer, resultando en un fallo.\n\nPara abordarlo, a\u00f1adir una comprobaci\u00f3n de cordura del tama\u00f1o del b\u00fafer de transferencia en prepare_silent_urb(), y detener la copia de datos si los datos recibidos se desbordan. Adem\u00e1s, informar correctamente del error de transferencia desde all\u00ed tambi\u00e9n.\n\nTenga en cuenta que esto no soluciona la causa ra\u00edz del error de reproducci\u00f3n en s\u00ed, sino que esto simplemente cubre el Oops del kernel."}], "id": "CVE-2026-43279", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43279", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:16:13.763153Z", "version": "2.0.3"}}]}, "published": "2026-05-06T12:16:49.350", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6af16f1b8649df4c00d6ced924bdd8b72c885b6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/780dc57794a217b49994fa1d0b42465fb10a00aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8995fc0e00b3fee9bf7ecb3d836b635b730c1049"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ccaf9296763be4f76b59e2cac377006016c34435"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fba2105a157fffcf19825e4eea498346738c9948"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fc9e5af60dc199051dc202ae78e1fe76a9977a5e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing", "id": "2467215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467215"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a local user."], "name": "CVE-2026-43279", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43279\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43279\nhttps://lore.kernel.org/linux-cve-announce/2026050613-CVE-2026-43279-4530@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,780dc57794a217b49994fa1d0b42465fb10a00aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8995fc0e00b3fee9bf7ecb3d836b635b730c1049)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fc9e5af60dc199051dc202ae78e1fe76a9977a5e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6af16f1b8649df4c00d6ced924bdd8b72c885b6a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ccaf9296763be4f76b59e2cac377006016c34435)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fba2105a157fffcf19825e4eea498346738c9948)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.202,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.165,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.128,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.75,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T15:15:09.164463+00:00", "updated": "2026-05-08T17:30:13.921811+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}