CVE-2026-98741 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ua101: reject mismatched capture/playback packet sizes
detect_usb_format() cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize and bNrChannels. Each playback URB gets a buffer of ua->playback.max_packet_bytes, while the number of bytes written into it is derived from the capture stream: capture_urb_complete() computes frames from the received capture packet and capture.frame_bytes, and start_usb_playback() and playback_work() multiply that by playback.frame_bytes.
A device declaring a large capture wMaxPacketSize with few capture channels and a small playback wMaxPacketSize with many playback channels therefore memset()s and memcpy()s past the end of the playback buffer, in open() of the PCM node the driver registers during probe. usb_submit_urb() rejects the over-long iso_frame_desc[0].length with
-EMSGSIZE, but only after the write.
Reject such descriptors at probe time. Genuine UA-101/UA-1000 hardware declares proportional packet sizes and is unaffected.
BUG: KASAN: slab-out-of-bounds in start_usb_playback (sound/usb/misc/ua101.c:586) Write of size 2048 at addr ffff8881098f3c00 by task exploit/5021 Call Trace: __asan_memset (mm/kasan/shadow.c:84) start_usb_playback (sound/usb/misc/ua101.c:586) playback_pcm_open (sound/usb/misc/ua101.c:679) snd_pcm_open_substream (sound/core/pcm_native.c:2829) snd_pcm_open (sound/core/pcm_native.c:2865 sound/core/pcm_native.c:2932) snd_pcm_playback_open (sound/core/pcm_native.c:2891) snd_open (sound/core/sound.c:166) chrdev_open (fs/char_dev.c:411) do_dentry_open (fs/open.c:996) vfs_open (fs/open.c:1101) path_openat (fs/namei.c:4837 fs/namei.c:5000) do_file_open (fs/namei.c:5029) do_sys_openat2 (fs/open.c:1417) __x64_sys_openat (fs/open.c:1423 fs/open.c:1439 fs/open.c:1434) do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The buggy address belongs to the object at ffff8881098f3c00 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes inside of allocated 168-byte region [ffff8881098f3c00, ffff8881098f3ca8)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel's ALSA USB audio driver for the UA-101 device contains a critical buffer overflow vulnerability arising from an insufficient validation of hardware descriptor parameters during initialization. The core issue lies in the detect_usb_format function, which validates certain subframe properties such as bSubframeSize and bBitResolution but fails to correlate the maximum packet sizes (wMaxPacketSize) with the number of channels for both capture and playback interfaces. This oversight creates a scenario where mismatched device configurations can lead to memory corruption during runtime operations. Specifically, if an attacker or a maliciously crafted USB device presents a large wMaxPacketSize for the capture interface paired with few channels, while simultaneously declaring a small wMaxPacketSize for the playback interface despite having many playback channels, the driver's internal logic will miscalculate buffer requirements. The driver allocates buffers based on the maximum packet size of each direction independently, assuming proportionality that is not guaranteed by the USB specification or enforced by the code.
During normal operation, when audio data flows through these endpoints, the capture stream determines the number of frames processed from received packets. This frame count is then multiplied by the bytes per frame for playback to determine how much data needs to be written into the playback buffer. Because the calculation relies on capture-derived metrics applied against a playback buffer sized according to its own potentially smaller maximum packet size, the resulting write operation can exceed the allocated memory region. The kernel's KASAN tool detected this as a slab-out-of-bounds error in start_usb_playback, where a write of significant size occurred within an allocated 168-byte kmalloc cache that was insufficient for the actual data volume being processed. This indicates that under specific device configurations, the driver performs unchecked memory writes past the end of its allocated buffer structures.
The operational impact of this vulnerability is severe, as it allows for out-of-bounds write operations which can lead to kernel instability, denial of service through system crashes, or potentially arbitrary code execution if an attacker can control the data being written and exploit adjacent memory structures. Although usb_submit_urb eventually rejects over-long iso_frame_desc lengths with an EMSGSIZE error, this check occurs after the buffer has already been corrupted by memset and memcpy operations. This timing flaw means that even though the transfer might be aborted later in the pipeline, the damage to kernel memory is already done during the open phase of the PCM node. The vulnerability specifically affects devices where the capture and playback packet sizes are not proportional to their respective channel counts, a condition that genuine UA-101 or UA-1000 hardware does not exhibit due to its consistent design parameters.
From a classification perspective, this flaw aligns with CWE-787: Out-of-bounds Write, as it involves writing data beyond the boundaries of an allocated buffer in kernel space. It also relates to CWE-20: Improper Input Validation, since the driver fails to adequately validate and cross-check input parameters from the USB device descriptors before allocating resources and processing streams. In terms of attack vectors, this vulnerability could be leveraged via physical access or through compromised USB devices acting as malicious peripherals, mapping to ATT&CK techniques involving peripheral device manipulation such as BadUSB scenarios where a device presents itself with crafted audio class descriptors to trigger kernel memory corruption upon connection and stream initialization.
To mitigate this risk, the resolution involves rejecting mismatched capture and playback packet size descriptors at probe time rather than allowing them to proceed to runtime operations. By validating that wMaxPacketSize correlates correctly with bNrChannels for both directions during device enumeration, the driver prevents the allocation of undersized buffers relative to the actual data volume expected from the stream logic. This proactive validation ensures that only devices adhering to proportional packet sizing are accepted by the subsystem. System administrators and users should ensure their Linux kernels are updated to include this patch, particularly if they interact with external USB audio interfaces or embedded systems utilizing similar ALSA drivers. Regular auditing of kernel updates for sound subsystem patches is recommended to maintain integrity against such hardware-level exploitation vectors.