CVE-2026-23208
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Prevent excessive number of frames In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer size for each data URB is maxpacksize * packets, which in this example is 40 * 6 = 240; When the user performs a write operation to send audio data into the ALSA PCM playback stream, the calculated number of frames is packsize[0] * packets = 264, which exceeds the allocated URB buffer size, triggering the out-of-bounds (OOB) issue reported by syzbot [1]. Added a check for the number of single data URB frames when calculating the number of frames to prevent [1]. [1] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506 Call Trace: copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611 prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333
How to fix
- linux linux_kernel4.14.188, 4.19.132, 5.4.51, 5.7.8, 6.18.10 or later
- git.kernel.org/stable/c/282aba56713bbc58155716b55ca7222b2d9cf3c8
- git.kernel.org/stable/c/480a1490c595a242f27493a4544b3efb21b29f6a
- git.kernel.org/stable/c/62932d9ed639a9fa71b4ac1a56766a4b43abb7e4
- git.kernel.org/stable/c/ab0b5e92fc36ee82c1bd01fe896d0f775ed5de41
- git.kernel.org/stable/c/c4dc012b027c9eb101583011089dea14d744e314
- git.kernel.org/stable/c/d67dde02049e632ba58d3c44a164a74b6a737154
- git.kernel.org/stable/c/e0ed5a36fb3ab9e7b9ee45cd17f09f6d5f594360
- git.kernel.org/stable/c/ef5749ef8b307bf8717945701b1b79d036af0a15
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.14.186 ≤ v < 4.14.188, 4.19.130 ≤ v < 4.19.132, 5.4.49 ≤ v < 5.4.51, 5.7.6 ≤ v < 5.7.8, 5.8 ≤ v < 6.18.10, 4.4.229, 4.9.229, 6.19 | 4.14.188, 4.19.132, 5.4.51, 5.7.8, 6.18.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.