CVE-2026-74641 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usx2y: bound the hwdep mmap fault offset
snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:
offset = vmf->pgoff << PAGE_SHIFT; vaddr = (char *)(...)->us428ctls_sharedmem + offset; page = virt_to_page(vaddr); get_page(page); vmf->page = page;
return 0;
snd_us428ctls_mmap() checks only the length of the mapping, never the offset, and us428ctls_sharedmem is a single page from alloc_pages_exact(). For a character device file_mmap_size_max() returns ULONG_MAX, so the mm layer imposes no ceiling either. Every page offset above zero resolves to a struct page outside the object, and the handler installs it into the caller's address space read-write; the vma is not marked read-only.
The caller picks the page frame with a single mmap() argument and gets read-write access to a page of kernel memory it does not own; an offset that lands in an unpopulated vmemmap region oopses instead.
A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved.
On 7.2.0-rc5 (arm64), mmap() with a large offset:
Unable to handle kernel paging request at virtual address fffffdffc45d5ac8 pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]
Call trace: snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]
__do_fault __handle_mm_fault handle_mm_fault el0_da
Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/23/2026
The Linux kernel vulnerability identified within the ALSA USB US-X2Y driver represents a critical out-of-bounds memory access issue stemming from insufficient validation of user-supplied input during hardware-dependent memory mapping operations. The core technical flaw resides in the snd_us428ctls_vm_fault function, which is responsible for handling page faults when an application attempts to map shared memory associated with the audio device. When a process invokes mmap on this character device file, the kernel calculates the virtual address by shifting the faulting page offset provided by the user and adding it to the base address of the us428ctls_sharedmem region. Crucially, there is no bounds checking performed against the actual size or boundaries of this shared memory object. The driver allocates only a single page for this shared memory using alloc_pages_exact, yet the mmap implementation allows any offset value passed by the caller to be translated into a kernel virtual address without verification that the resulting address falls within the allocated region.
This lack of validation leads to severe operational impacts depending on the specific offset provided by an unprivileged user space process. If the calculated offset results in a valid physical page frame outside the intended shared memory area, the driver installs this unrelated page into the caller's address space with read-write permissions. This effectively grants unauthorized access to arbitrary kernel memory pages that do not belong to the application, violating fundamental isolation principles and potentially exposing sensitive kernel data or allowing for further exploitation vectors such as privilege escalation if combined with other vulnerabilities. The vulnerability is particularly dangerous because the virtual memory area is not marked as read-only by default, meaning any page mapped through this flawed mechanism can be both read from and written to by the user process. In scenarios where the offset calculation lands in an unpopulated vmemmap region or invalid kernel address space, the system triggers a fatal kernel paging request error, resulting in a local denial of service through a kernel panic or oops condition that requires a reboot to restore normal operation.
The attack surface for this vulnerability is relatively accessible as it does not require any special capabilities or root privileges to exploit. A process only needs the ability to open the hwdep node associated with an attached US-X2Y device, which typically occurs after loading an FPGA image through the same interface. This means that local users who can interact with USB audio devices connected to the system are directly affected. The vulnerability affects multiple handlers within the usx2y driver family; specifically, the pcm hwdep handler in usx2yhwdeppcm.c employs a similar address calculation method and suffers from the identical lack of offset bounds checking, thereby expanding the potential points of exploitation across different interfaces provided by the same driver module.
From a classification perspective, this vulnerability aligns with CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer, as it allows an actor to perform operations on memory locations beyond their intended boundaries due to missing input validation. It also relates to CWE-284 Improper Access Control because the mechanism fails to enforce proper access restrictions on kernel resources based on user identity or privilege level. In terms of ATT&CK mapping, this flaw facilitates lateral movement and defense evasion techniques by allowing local users to read from and write to arbitrary kernel memory, which can be leveraged for credential dumping or modifying system state without detection. The discovery was attributed to XBOW with triage support from Baul Lee, highlighting the importance of rigorous code review in kernel subsystems handling hardware interactions.
To mitigate this vulnerability, developers must implement strict bounds checking on all page offsets before they are used to calculate virtual addresses for memory mapping operations. Specifically, both snd_us428ctls_vm_fault and the corresponding handler in usx2yhwdeppcm.c need to verify that the requested offset plus the mapped length does not exceed the size of the allocated shared memory region. This validation should occur prior to any page table manipulation or address resolution logic. Additionally, applying principle of least privilege by marking virtual memory areas as read-only where write access is not strictly necessary can reduce the impact if an out-of-bounds mapping were somehow achieved. System administrators and users should ensure that their Linux kernels are updated with patches addressing this specific ALSA USB US-X2Y driver flaw to prevent unauthorized kernel memory access and potential system instability caused by invalid page fault handling.