CVE-2026-74498 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
When a USB audio endpoint requests full packet transfers via the fill_max descriptor flag, data_ep_set_params() promotes ep->curpacksize to ep->maxpacksize. However, maxsize is left at the original sample-rate derived value.
Since u->buffer_size is allocated as maxsize * packets, the resulting DMA buffer is far too small for the requested transfer length. When the USB host controller streams up to curpacksize bytes per packet, it writes past the end of the buffer via DMA, corrupting kernel heap memory.
Update maxsize to curpacksize when fill_max is set so that the allocated DMA buffer size matches the actual transfer request size.
[ changed to reassign maxsize only when ep->fill_max is set -- tiwai ]
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's Advanced Linux Sound Architecture implementation specifically in the usb-audio subsystem where improper handling of USB audio endpoint parameters leads to a critical out-of-bounds memory write condition. The flaw occurs during the processing of USB audio transfers when the fill_max descriptor flag is utilized to request full packet transfers from USB audio endpoints, creating a fundamental mismatch between allocated buffer dimensions and actual data transfer requirements. The technical implementation demonstrates a classic buffer management error where the system fails to properly synchronize endpoint parameter updates with memory allocation calculations.
The vulnerability stems from a specific code path in the data_ep_set_params() function where ep->curpacksize is correctly promoted to ep->maxpacksize when fill_max flag is set, but the crucial variable maxsize retains its original sample-rate derived value. This creates a scenario where u->buffer_size calculation uses the outdated maxsize value multiplied by packet count to determine DMA buffer allocation size. The resulting buffer dimensions become insufficient for the actual data transfer demands, as the USB host controller operates under the assumption of curpacksize bytes per packet while the kernel allocates memory based on the stale maxsize parameter.
When USB audio streaming commences with full packet transfers enabled, the system encounters a heap memory corruption scenario where the USB controller writes data beyond the allocated buffer boundaries through DMA operations. This out-of-bounds write represents a severe security risk that could potentially allow privilege escalation or system instability, as kernel heap memory corruption often provides attackers with opportunities to execute arbitrary code or cause denial of service conditions.
This vulnerability maps directly to CWE-121 and CWE-787 which define buffer overflow conditions and out-of-bounds memory access issues respectively. The flaw aligns with ATT&CK technique T1068 which covers local privilege escalation through kernel vulnerabilities, and T1547.001 covering kernel module manipulation. The specific nature of the vulnerability demonstrates poor input validation and memory management practices within the USB audio subsystem's endpoint parameter handling logic.
The recommended mitigation involves updating the maxsize variable assignment to occur only when ep->fill_max is actually set, ensuring that buffer allocation calculations properly reflect the current transfer parameters rather than retaining stale values from previous endpoint configurations. This fix addresses the root cause by synchronizing the endpoint parameter state with memory allocation decisions, preventing the mismatch between expected and actual data transfer sizes that leads to heap corruption.
The fix implementation requires careful attention to the exact conditions under which maxsize should be reassigned, as indicated in the patch notes where the change specifically targets reassignment only when ep->fill_max is set. This targeted approach ensures that memory allocation accurately reflects the current USB endpoint configuration while maintaining backward compatibility for cases where fill_max is not enabled. The solution demonstrates proper resource management principles and adheres to secure coding practices that prevent buffer overflows through careful parameter synchronization.
This vulnerability highlights the importance of proper state management in kernel subsystems, particularly when dealing with hardware-specific parameters that affect memory allocation decisions. The fix represents a defensive programming approach that validates all input parameters before making critical resource allocation decisions, preventing scenarios where hardware configuration flags can lead to memory corruption through improper buffer sizing calculations.