Cloudanix VulnDB

CVE-2026-98769

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A USB device running certain Linux audio features can be tricked by a connected computer into overwriting its own memory, which may crash the device or let an attacker take control.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read/write on a 5-element heap array via unchecked low-nibble index (0-15) derived from a USB control request bRequest, performed inside an IRQ completion handler.

Why it matters to the business

Kernel memory corruption on Linux devices exposing USB audio gadget functions can cause crashes, data leaks, or arbitrary code execution; the flaw affects any kernel build containing the legacy UAC1 gadget driver.

How an attack unfolds

An attacker acting as a malicious USB host enumerates a vulnerable Linux USB gadget device, then issues crafted class-specific SET_CUR or GET_CUR requests containing bRequest values whose low nibble exceeds the array size, triggering the out-of-bounds access directly from the USB request completion path with no additional privileges required.

How to fix it

Apply the upstream patch that adds ARRAY_SIZE() bounds checks in generic_set_cmd() and generic_get_cmd(); rebuild and deploy a fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the presence of the ARRAY_SIZE guard in the f_uac1_legacy source; test by sending bRequest values with low nibble 5-15 and verify that requests are now rejected rather than accessing memory beyond the array.

Typical attack path

  1. Attacker presents a USB host controller to the target device
  2. Target enumerates the f_uac1_legacy gadget function
  3. Attacker transmits a class-specific control request with bRequest low nibble >= 5
  4. generic_set_cmd or generic_get_cmd indexes beyond the 5-element data array
  5. Heap corruption occurs inside the IRQ handler context

How to detect it

Review kernel logs for USB gadget or audio control request errors around the time of suspected exposure; inspect USB traffic captures for class-specific SET_CUR/GET_CUR requests whose bRequest low nibble exceeds 4.

What your security team should do

  • Immediately identify all systems exposing USB gadget functions and schedule kernel updates
  • Disable the f_uac1_legacy gadget where USB audio is not required
  • Monitor vendor advisories for distribution-specific backports of the fix
  • Re-test USB gadget enumeration after patching to ensure normal operation

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index into con->data[]: u8 cmd = (ctrl->bRequest & 0x0F); /* 0 .. 15 */ ... con->data[cmd] = value; /* OOB when cmd >= 5 */ struct usb_audio_control (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap. A malicious USB host can craft a class-specific SET_CUR / GET_CUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions. Add an ARRAY_SIZE() guard to both functions.

Affected packages

Ecosystem Package Introduced Fixed