CVE-2026-98265

What it actually does

The flaw permits a slab-out-of-bounds write in prepare_playback_urb when an implicit-feedback USB audio endpoint supplies a packet count larger than the data URB's allocated iso_frame_desc slots, because the driver records only the original endpoint limit and does not clamp the adopted count or packet-size copy before writing descriptors.

Why it matters to the business

Systems that attach untrusted or specially crafted USB audio devices can experience kernel crashes, memory corruption, or potential local privilege escalation, resulting in denial of service or full host compromise during normal audio streaming.

How an attack unfolds

An attacker presents a high-speed UAC2 device declaring mismatched bInterval values (capture interval 1 yielding 8 packets, playback interval 4 yielding 1 packet); on the first capture URB completion the driver overwrites seven descriptors beyond the single-packet URB allocation, triggering the out-of-bounds write inside the URB completion path.

How to fix it

Apply the upstream ALSA fix that records the allocated packet count per endpoint and clamps both the adopted packet count and packet-size copy to that limit before any URB descriptor writes; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting sound/usb/pcm.c and sound/usb/endpoint.c for the new clamping logic around urb_packs and ctx->packets; test with a device declaring bInterval 1 capture and bInterval 4 playback to verify no out-of-bounds access occurs.

Typical attack path

1. Attach malicious high-speed UAC2 USB audio device to a vulnerable Linux host
2. Start an audio playback stream that activates implicit feedback
3. First capture completion invokes snd_complete_urb and snd_usb_queue_pending_output_urbs
4. prepare_playback_urb writes past the end of the allocated iso_frame_desc array
5. Kernel memory corruption or KASAN report occurs

How to detect it

Search kernel logs and KASAN reports for slab-out-of-bounds writes originating from prepare_playback_urb or prepare_silent_urb in the sound/usb directory, especially following USB audio stream start events.

What your security team should do

• Prioritize kernel updates containing the ALSA usb-audio clamp fix on all endpoints that support USB audio
• Restrict physical or virtual USB device attachment to trusted hardware only
• Enable kernel hardening features such as KASAN or lockdown mode in test environments to surface similar issues early
• Review logs for USB audio URB completion paths after any new device attachment