CVE-2026-98265 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
data_ep_set_params() allocates each data URB for exactly u->packets isochronous frames, so urb->iso_frame_desc[] has u->packets slots and
ctx->packets is the driver's only record of that limit. For an implicit feedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the sync source's packet count, which is calculated independently from the capture endpoint's parameters. When that count is larger, prepare_playback_urb() and prepare_silent_urb() can write iso_frame_desc[] past the allocation; their existing bounds limit payload
bytes, not the descriptor index.
The reproducer uses a high-speed UAC2 device declaring bInterval 1 for implicit feedback capture (8 packets) and bInterval 4 for playback (1 packet). On the first capture completion after the stream starts, it accesses seven descriptors spanning 112 bytes beyond the one-packet URB:
BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560) Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178 prepare_playback_urb (sound/usb/pcm.c:1560) prepare_outbound_urb (sound/usb/endpoint.c:340) snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501) snd_complete_urb (sound/usb/endpoint.c:1834) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741) vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107) kthread (kernel/kthread.c:436) The buggy address belongs to the object at ffff88801e696a00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)
Record the allocated packet count per endpoint and clamp both the adopted count and the packet-size copy to it. Fold the Format Type II delimiter into urb_packs before the allocation loop so the recorded limit matches every URB.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel's ALSA USB audio subsystem contains a critical out-of-bounds write vulnerability within the implicit feedback mechanism for isochronous endpoints, specifically affecting devices that utilize asynchronous clocking schemes to synchronize playback and capture streams. This flaw arises from an inconsistency in how packet counts are tracked and applied across different stages of Universal Serial Bus (USB) request block processing. When a USB audio device operates with implicit feedback, the driver must manage two distinct isochronous endpoints: one for output or playback and another for input or capture. The synchronization logic relies on reading timing information from the capture endpoint to adjust the playback stream's clocking. However, the implementation incorrectly overwrites the packet count variable associated with the data endpoint using the packet count derived from the sync source endpoint without verifying that this new value is compatible with the memory already allocated for the output endpoint's USB request blocks.
The technical root cause lies in the function snd_usb_queue_pending_output_urbs(), which prepares outgoing audio streams by allocating Uniform Resource Block structures sized according to a specific number of packets determined at initialization time via data_ep_set_params(). This allocation creates an array of isochronous frame descriptors with a fixed size corresponding to the initial packet count. Later, when handling implicit feedback for a sink device, the driver updates ctx->packets using the sync source's calculated packet interval. If this new value exceeds the originally allocated limit, subsequent functions such as prepare_playback_urb() and prepare_silent_urb() proceed to write into the iso_frame_desc array beyond its bounds. The existing validation logic only checks payload byte limits rather than descriptor index boundaries, allowing writes that exceed the allocated memory region by significant margins depending on device configuration.
This vulnerability is particularly exploitable in scenarios involving high-speed USB Audio Class 2 devices configured with disparate intervals for capture and playback operations. For instance, a device declaring an interval of one millisecond for implicit feedback capture versus four milliseconds for playback results in a mismatch where the driver attempts to process eight packets against a buffer allocated for only one packet. During the first completion interrupt after stream initiation, the kernel executes writes spanning multiple descriptors beyond the end of the 208-byte allocation region. Kernel Address Sanitizer reports confirm slab-out-of-bounds errors occurring at specific memory addresses within kmalloc caches, indicating direct heap corruption that can lead to system instability or potential privilege escalation if an attacker controls device parameters through virtualized USB interfaces such as usbip.
From a security classification perspective, this issue aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write in the Common Weakness Enumeration taxonomy. In terms of attack vectors, it relates to ATT&CK technique T1564.003 Hidden Window or Process Injection if exploited for code execution, though primarily it represents a denial of service risk through kernel panic due to memory corruption. The vulnerability highlights the dangers of trusting external device descriptors without rigorous bounds checking against internal allocation limits, a pattern that can be triggered remotely via USBIP virtualization layers where malicious clients present crafted endpoint configurations.
Mitigation strategies require immediate patching of the ALSA usb-audio driver to enforce strict clamping of implicit feedback packet counts against actual URB capacity constraints. The fix involves recording the allocated packet count per endpoint and ensuring both adopted counts and payload size copies are bounded by this limit before any memory access occurs. Developers must also fold Format Type II delimiters into the packet calculation prior to allocation loops so that recorded limits accurately reflect every USB request block's requirements. System administrators should apply kernel updates promptly, particularly in environments utilizing virtualized USB devices or untrusted audio peripherals, and monitor for anomalies related to isochronous endpoint handling in audit logs.