CVE-2026-93122 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uac: validate rate list length before storing
UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UAC_MAX_RATES entries, but the store paths do not check that the input contains at most that many tokens before writing through opts->name##s[i++].
Writing more than ten rates therefore writes past the end of the p_srates[] or c_srates[] array in struct f_uac1_opts or struct
f_uac2_opts.
With CONFIG_UBSAN_BOUNDS enabled, writing an 11-entry rate list to the UAC1 p_srate attribute reports:
UBSAN: array-index-out-of-bounds drivers/usb/gadget/function/f_uac1.c:1669:1 index 10 is out of range for type 'int [10]'
__ubsan_handle_out_of_bounds.cold f_uac1_opts_p_srate_store configfs_write_iter vfs_write ksys_write do_syscall_64
The same reproducer against the UAC2 p_srate attribute reports:
UBSAN: array-index-out-of-bounds drivers/usb/gadget/function/f_uac2.c:2087:1 index 10 is out of range for type 'int [10]'
__ubsan_handle_out_of_bounds.cold f_uac2_opts_p_srate_store configfs_write_iter vfs_write ksys_write do_syscall_64
Reject additional tokens once UAC_MAX_RATES entries have been parsed. Also keep the original kstrdup() pointer for kfree(), because strsep() advances the parsing cursor. Freeing the advanced cursor leaks the original buffer on successful parses and can free an interior pointer on some error paths.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel contains a critical out-of-bounds write vulnerability within the USB Audio Class gadget driver implementation, specifically affecting both UAC1 and UAC2 configuration file system attributes. This flaw arises from insufficient input validation when parsing comma-separated lists of sampling rates provided by userspace applications. The underlying data structures utilize fixed-size arrays defined by the constant UAC_MAX_RATES to store these parsed values. However, the storage functions responsible for processing user-supplied rate lists fail to verify that the number of tokens in the input string does not exceed this predefined limit before attempting to write each value into the array. This lack of boundary checking creates a classic buffer overflow condition where writing more than ten sampling rates results in memory writes beyond the allocated bounds of the p_srates or c_srates arrays within the f_uac1_opts and f_uac2_opts structures respectively.
From a technical perspective, this vulnerability is classified as an out-of-bounds write, corresponding to CWE-787 in the Common Weakness Enumeration standard. The operational impact manifests when a malicious or misconfigured user space process supplies a rate list containing more than ten entries. Upon execution of the store operation via configfs, the kernel attempts to index into the array using an incrementing counter that is not constrained by the maximum allowed count. This behavior triggers undefined memory access patterns which can be detected through tools like UndefinedBehaviorSanitizer when CONFIG_UBSAN_BOUNDS is enabled. The stack traces indicate that the out-of-bounds access occurs deep within the syscall handling path, specifically during the write iteration process for configfs attributes. Such an overflow poses significant security risks as it allows potential overwriting of adjacent kernel memory structures, which could lead to data corruption, privilege escalation, or system instability depending on what lies beyond the array boundary in memory layout.
The remediation strategy involves implementing strict input validation prior to any storage operations. The fix requires checking the count of parsed tokens against UAC_MAX_RATES and rejecting inputs that exceed this limit with an appropriate error code. Additionally, the patch addresses a secondary issue related to memory management during string parsing. The original implementation used strsep for tokenization but failed to preserve the pointer returned by kstrdup before passing it to strsep. Since strsep modifies its argument to point to the next token, failing to retain the initial allocation address leads to two distinct bugs: on successful parse paths, the original buffer is never freed causing a memory leak, and on error paths, there is a risk of freeing an interior pointer rather than the base address allocated by kstrdup. Correcting this requires storing the result of kstrdup in a separate variable for use during deallocation while allowing strsep to safely advance through the string for parsing purposes.
This vulnerability aligns with ATT&CK technique T1059, specifically command and script interpretation variants where attackers might exploit kernel interfaces to execute arbitrary code or disrupt service availability. The fix ensures that only valid rate lists are accepted by the audio gadget driver, thereby closing the attack surface associated with malformed configfs inputs. System administrators should ensure their kernels are updated to include this patch which enforces proper bounds checking and corrects memory management practices in the USB function filesystem layer. By validating input length against static array limits and fixing pointer handling during string manipulation, the integrity of kernel heap allocations is preserved preventing potential exploitation vectors related to buffer overflows and resource leaks.