CVE-2026-74682

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74682", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.925Z", "datePublished": "2026-08-22T15:32:49.527Z", "dateUpdated": "2026-11-06T17:05:51.379Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:49.527Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write on Type II inbound URBs\n\ndata_ep_set_params() sizes each URB transfer buffer before it adds the\nFormat Type II transfer delimiter:\n\n\tu->packets = urb_packs;\n\tu->buffer_size = maxsize * u->packets;\n\n\tif (fmt->fmt_type == UAC_FORMAT_TYPE_II)\n\t\tu->packets++; /* for transfer delimiter */\n\tu->urb = usb_alloc_urb(u->packets, GFP_KERNEL);\n\nbuffer_size is computed from the pre-increment packet count and never\nrecomputed, so for a Type II endpoint the buffer is one packet short of\nthe packet count the URB is built with.\n\nprepare_inbound_urb() then lays out one iso frame per packet and never\nconsults buffer_size:\n\n\toffs = 0;\n\tfor (i = 0; i < urb_ctx->packets; i++) {\n\t\turb->iso_frame_desc[i].offset = offs;\n\t\turb->iso_frame_desc[i].length = ep->curpacksize;\n\t\toffs += ep->curpacksize;\n\t}\n\n\turb->transfer_buffer_length = offs;\n\turb->number_of_packets = urb_ctx->packets;\n\nThe last descriptor therefore points one packet past the end of the\ntransfer buffer, where the host controller writes device data on every\ninbound transfer. prepare_silent_urb() and prepare_playback_urb() bound\ntheir fill loops by ctx->buffer_size, so only capture is affected.\n\nfmt_type comes from the device's audio streaming descriptors, so any\ndevice advertising a Type II capture format hits this once userspace sets\nhw_params on the stream.\n\nKASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report\nper inbound transfer:\n\n BUG: KASAN: slab-out-of-bounds in dummy_timer\n Write of size 64 at addr ffff0000186171c0 by task cons02/166\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Allocated by task 166:\n usb_alloc_coherent\n snd_usb_endpoint_set_params\n The buggy address is located 0 bytes to the right of\n allocated 64-byte region [ffff000018617180, ffff0000186171c0)\n\nCompute buffer_size after the delimiter packet has been accounted for,\nand bound the fill loop by buffer_size, as prepare_silent_urb() already\ndoes on the outbound side. This grows every Type II URB allocation by\none maxsize packet.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/endpoint.c"], "versions": [{"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "6af5f29af7711233ae68d3b25c15d67478468900", "status": "affected", "versionType": "git"}, {"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "f1fbb50b99311b35c2e85cc70341d62082dca4b5", "status": "affected", "versionType": "git"}, {"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "137bf034740e5a2734794908d0aff1e0bd7cee6e", "status": "affected", "versionType": "git"}, {"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "6607f85242577f33d4540a0d1f4a6137f5367058", "status": "affected", "versionType": "git"}, {"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a", "status": "affected", "versionType": "git"}, {"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "0a235379825e1a6194e43861ee6658e5fc35686d", "status": "affected", "versionType": "git"}, {"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "d3ed4e6321bb453757044cb9e5ecb30a33f04903", "status": "affected", "versionType": "git"}, {"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "69ee44e1a23be62318189dc4b37fa4ad94053269", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/endpoint.c"], "versions": [{"version": "3.5", "status": "affected"}, {"version": "0", "lessThan": "3.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900"}, {"url": "https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5"}, {"url": "https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e"}, {"url": "https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058"}, {"url": "https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a"}, {"url": "https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d"}, {"url": "https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903"}, {"url": "https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269"}], "title": "ALSA: usb-audio: fix OOB write on Type II inbound URBs", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74682", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:01:20.774649Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:05:51.379Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74682", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:01:20.774649Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:01:22.459Z"}}], "cna": {"title": "ALSA: usb-audio: fix OOB write on Type II inbound URBs", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "6af5f29af7711233ae68d3b25c15d67478468900", "versionType": "git"}, {"status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "f1fbb50b99311b35c2e85cc70341d62082dca4b5", "versionType": "git"}, {"status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "137bf034740e5a2734794908d0aff1e0bd7cee6e", "versionType": "git"}, {"status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "6607f85242577f33d4540a0d1f4a6137f5367058", "versionType": "git"}, {"status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a", "versionType": "git"}, {"status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "0a235379825e1a6194e43861ee6658e5fc35686d", "versionType": "git"}, {"status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "d3ed4e6321bb453757044cb9e5ecb30a33f04903", "versionType": "git"}, {"status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "lessThan": "69ee44e1a23be62318189dc4b37fa4ad94053269", "versionType": "git"}], "programFiles": ["sound/usb/endpoint.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.5"}, {"status": "unaffected", "version": "0", "lessThan": "3.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/usb/endpoint.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900"}, {"url": "https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5"}, {"url": "https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e"}, {"url": "https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058"}, {"url": "https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a"}, {"url": "https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d"}, {"url": "https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903"}, {"url": "https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write on Type II inbound URBs\n\ndata_ep_set_params() sizes each URB transfer buffer before it adds the\nFormat Type II transfer delimiter:\n\n\tu->packets = urb_packs;\n\tu->buffer_size = maxsize * u->packets;\n\n\tif (fmt->fmt_type == UAC_FORMAT_TYPE_II)\n\t\tu->packets++; /* for transfer delimiter */\n\tu->urb = usb_alloc_urb(u->packets, GFP_KERNEL);\n\nbuffer_size is computed from the pre-increment packet count and never\nrecomputed, so for a Type II endpoint the buffer is one packet short of\nthe packet count the URB is built with.\n\nprepare_inbound_urb() then lays out one iso frame per packet and never\nconsults buffer_size:\n\n\toffs = 0;\n\tfor (i = 0; i < urb_ctx->packets; i++) {\n\t\turb->iso_frame_desc[i].offset = offs;\n\t\turb->iso_frame_desc[i].length = ep->curpacksize;\n\t\toffs += ep->curpacksize;\n\t}\n\n\turb->transfer_buffer_length = offs;\n\turb->number_of_packets = urb_ctx->packets;\n\nThe last descriptor therefore points one packet past the end of the\ntransfer buffer, where the host controller writes device data on every\ninbound transfer. prepare_silent_urb() and prepare_playback_urb() bound\ntheir fill loops by ctx->buffer_size, so only capture is affected.\n\nfmt_type comes from the device's audio streaming descriptors, so any\ndevice advertising a Type II capture format hits this once userspace sets\nhw_params on the stream.\n\nKASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report\nper inbound transfer:\n\n BUG: KASAN: slab-out-of-bounds in dummy_timer\n Write of size 64 at addr ffff0000186171c0 by task cons02/166\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Allocated by task 166:\n usb_alloc_coherent\n snd_usb_endpoint_set_params\n The buggy address is located 0 bytes to the right of\n allocated 64-byte region [ffff000018617180, ffff0000186171c0)\n\nCompute buffer_size after the delimiter packet has been accounted for,\nand bound the fill loop by buffer_size, as prepare_silent_urb() already\ndoes on the outbound side. This grows every Type II URB allocation by\none maxsize packet.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "3.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:49.527Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74682", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:05:51.379Z", "dateReserved": "2026-08-15T05:44:03.925Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:49.527Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/endpoint.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6af5f29af7711233ae68d3b25c15d67478468900", "status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "versionType": "git"}, {"lessThan": "f1fbb50b99311b35c2e85cc70341d62082dca4b5", "status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "versionType": "git"}, {"lessThan": "137bf034740e5a2734794908d0aff1e0bd7cee6e", "status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "versionType": "git"}, {"lessThan": "6607f85242577f33d4540a0d1f4a6137f5367058", "status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "versionType": "git"}, {"lessThan": "ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a", "status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "versionType": "git"}, {"lessThan": "0a235379825e1a6194e43861ee6658e5fc35686d", "status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "versionType": "git"}, {"lessThan": "d3ed4e6321bb453757044cb9e5ecb30a33f04903", "status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "versionType": "git"}, {"lessThan": "69ee44e1a23be62318189dc4b37fa4ad94053269", "status": "affected", "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/endpoint.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.5"}, {"lessThan": "3.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write on Type II inbound URBs\n\ndata_ep_set_params() sizes each URB transfer buffer before it adds the\nFormat Type II transfer delimiter:\n\n\tu->packets = urb_packs;\n\tu->buffer_size = maxsize * u->packets;\n\n\tif (fmt->fmt_type == UAC_FORMAT_TYPE_II)\n\t\tu->packets++; /* for transfer delimiter */\n\tu->urb = usb_alloc_urb(u->packets, GFP_KERNEL);\n\nbuffer_size is computed from the pre-increment packet count and never\nrecomputed, so for a Type II endpoint the buffer is one packet short of\nthe packet count the URB is built with.\n\nprepare_inbound_urb() then lays out one iso frame per packet and never\nconsults buffer_size:\n\n\toffs = 0;\n\tfor (i = 0; i < urb_ctx->packets; i++) {\n\t\turb->iso_frame_desc[i].offset = offs;\n\t\turb->iso_frame_desc[i].length = ep->curpacksize;\n\t\toffs += ep->curpacksize;\n\t}\n\n\turb->transfer_buffer_length = offs;\n\turb->number_of_packets = urb_ctx->packets;\n\nThe last descriptor therefore points one packet past the end of the\ntransfer buffer, where the host controller writes device data on every\ninbound transfer. prepare_silent_urb() and prepare_playback_urb() bound\ntheir fill loops by ctx->buffer_size, so only capture is affected.\n\nfmt_type comes from the device's audio streaming descriptors, so any\ndevice advertising a Type II capture format hits this once userspace sets\nhw_params on the stream.\n\nKASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report\nper inbound transfer:\n\n BUG: KASAN: slab-out-of-bounds in dummy_timer\n Write of size 64 at addr ffff0000186171c0 by task cons02/166\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Allocated by task 166:\n usb_alloc_coherent\n snd_usb_endpoint_set_params\n The buggy address is located 0 bytes to the right of\n allocated 64-byte region [ffff000018617180, ffff0000186171c0)\n\nCompute buffer_size after the delimiter packet has been accounted for,\nand bound the fill loop by buffer_size, as prepare_silent_urb() already\ndoes on the outbound side. This grows every Type II URB allocation by\none maxsize packet.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: usb-audio: corrige escritura fuera de l\u00edmites en URBs entrantes de Tipo II\n\ndata_ep_set_params() dimensiona cada b\u00fafer de transferencia URB antes de a\u00f1adir el delimitador de transferencia de Formato Tipo II:\n\n\tu -> packets = urb_packs;\n\tu -> buffer_size = maxsize * u -> packets;\n\n\tif (fmt -> fmt_type == UAC_FORMAT_TYPE_II)\n\t\tu -> packets++; /* for transfer delimiter */\n\tu -> urb = usb_alloc_urb(u -> packets, GFP_KERNEL);\n\nbuffer_size se calcula a partir del recuento de paquetes previo al incremento y nunca se vuelve a calcular, por lo que para un punto final de Tipo II el b\u00fafer tiene un paquete menos que el recuento de paquetes con el que se construye el URB.\n\nprepare_inbound_urb() luego organiza un marco iso por paquete y nunca consulta buffer_size:\n\n\toffs = 0;\n\tfor (i = 0; i < urb_ctx -> packets; i++) {\n\t\turb -> iso_frame_desc[i].offset = offs;\n\t\turb -> iso_frame_desc[i].length = ep -> curpacksize;\n\t\toffs += ep -> curpacksize;\n\t}\n\n\turb -> transfer_buffer_length = offs;\n\turb -> number_of_packets = urb_ctx -> packets;\n\nEl \u00faltimo descriptor, por lo tanto, apunta un paquete m\u00e1s all\u00e1 del final del b\u00fafer de transferencia, donde el controlador de host escribe datos del dispositivo en cada transferencia entrante. prepare_silent_urb() y prepare_playback_urb() limitan sus bucles de llenado por ctx -> buffer_size, por lo que solo la captura se ve afectada.\n\nfmt_type proviene de los descriptores de transmisi\u00f3n de audio del dispositivo, por lo que cualquier dispositivo que anuncie un formato de captura de Tipo II encuentra esto una vez que el espacio de usuario establece hw_params en el flujo.\n\nKASAN en 7.2.0-rc5 (arm64) con un dispositivo dummy_hcd/raw-gadget, un informe por transferencia entrante:\n\n BUG: KASAN: slab-out-of-bounds in dummy_timer\n Write of size 64 at addr ffff0000186171c0 by task cons02/166\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Allocated by task 166:\n usb_alloc_coherent\n snd_usb_endpoint_set_params\n The buggy address is located 0 bytes to the right of\n allocated 64-byte region [ffff000018617180, ffff0000186171c0)\n\nCalcule buffer_size despu\u00e9s de que se haya contabilizado el paquete delimitador, y limite el bucle de llenado por buffer_size, como ya hace prepare_silent_urb() en el lado de salida. Esto aumenta cada asignaci\u00f3n de URB de Tipo II en un paquete de tama\u00f1o m\u00e1ximo.\n\nDescubierto por XBOW, clasificado por Baul Lee <baul.lee@xbow.com>"}], "id": "CVE-2026-74682", "lastModified": "2026-11-06T17:19:54.510", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74682", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:01:20.774649Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:42.480", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: usb-audio: fix OOB write on Type II inbound URBs", "id": "2521433", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521433"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: usb-audio: fix OOB write on Type II inbound URBs\ndata_ep_set_params() sizes each URB transfer buffer before it adds the\nFormat Type II transfer delimiter:\nu->packets = urb_packs;\nu->buffer_size = maxsize * u->packets;\nif (fmt->fmt_type == UAC_FORMAT_TYPE_II)\nu->packets++; /* for transfer delimiter */\nu->urb = usb_alloc_urb(u->packets, GFP_KERNEL);\nbuffer_size is computed from the pre-increment packet count and never\nrecomputed, so for a Type II endpoint the buffer is one packet short of\nthe packet count the URB is built with.\nprepare_inbound_urb() then lays out one iso frame per packet and never\nconsults buffer_size:\noffs = 0;\nfor (i = 0; i < urb_ctx->packets; i++) {\nurb->iso_frame_desc[i].offset = offs;\nurb->iso_frame_desc[i].length = ep->curpacksize;\noffs += ep->curpacksize;\n}\nurb->transfer_buffer_length = offs;\nurb->number_of_packets = urb_ctx->packets;\nThe last descriptor therefore points one packet past the end of the\ntransfer buffer, where the host controller writes device data on every\ninbound transfer. prepare_silent_urb() and prepare_playback_urb() bound\ntheir fill loops by ctx->buffer_size, so only capture is affected.\nfmt_type comes from the device's audio streaming descriptors, so any\ndevice advertising a Type II capture format hits this once userspace sets\nhw_params on the stream.\nKASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report\nper inbound transfer:\nBUG: KASAN: slab-out-of-bounds in dummy_timer\nWrite of size 64 at addr ffff0000186171c0 by task cons02/166\n__asan_memcpy\ndummy_timer\nhrtimer_run_softirq\nAllocated by task 166:\nusb_alloc_coherent\nsnd_usb_endpoint_set_params\nThe buggy address is located 0 bytes to the right of\nallocated 64-byte region [ffff000018617180, ffff0000186171c0)\nCompute buffer_size after the delimiter packet has been accounted for,\nand bound the fill loop by buffer_size, as prepare_silent_urb() already\ndoes on the outbound side. This grows every Type II URB allocation by\none maxsize packet.\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>", "A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio driver. This vulnerability involves an out-of-bounds write, where the system attempts to write data beyond the allocated memory buffer. This occurs due to incorrect buffer sizing when processing data from certain USB audio devices. A local attacker, by connecting a malicious USB audio device, could exploit this to cause memory corruption, potentially leading to system instability or information disclosure."], "name": "CVE-2026-74682", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74682\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74682\nhttps://lore.kernel.org/linux-cve-announce/2026082232-CVE-2026-74682-dc58@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8fdff6a319e7dac757c558bd283dc4577e68cde7,6af5f29af7711233ae68d3b25c15d67478468900)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8fdff6a319e7dac757c558bd283dc4577e68cde7,f1fbb50b99311b35c2e85cc70341d62082dca4b5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8fdff6a319e7dac757c558bd283dc4577e68cde7,137bf034740e5a2734794908d0aff1e0bd7cee6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8fdff6a319e7dac757c558bd283dc4577e68cde7,6607f85242577f33d4540a0d1f4a6137f5367058)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8fdff6a319e7dac757c558bd283dc4577e68cde7,ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8fdff6a319e7dac757c558bd283dc4577e68cde7,0a235379825e1a6194e43861ee6658e5fc35686d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8fdff6a319e7dac757c558bd283dc4577e68cde7,d3ed4e6321bb453757044cb9e5ecb30a33f04903)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8fdff6a319e7dac757c558bd283dc4577e68cde7,69ee44e1a23be62318189dc4b37fa4ad94053269)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.265,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T19:00:14.811402+00:00", "updated": "2026-08-25T18:00:15.521507+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}