CVE-2026-93808
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes. Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.
How to fix
- Linux Linux91acd231f219452fa58285239f83945accad9513, 7cc6b3745a0cea697c8d0684b3094f220281a08d, add9328c91c195c494cd68a21b19e5e47a20d784, 319393151367e6626affedcdd4f7b7b0286f4246, af8a172c4f71ac30d625f2966d2389a7fa872819, 74f3c639f64fa5da4e1613149798b5089bce2807, aba30af07d4fe499b50209801eba9da8a815522f or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 523f1dce37434a9a6623bf46e7893e2b4b10ac3c ≤ v < 91acd231f219452fa58285239f83945accad9513, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c ≤ v < 7cc6b3745a0cea697c8d0684b3094f220281a08d, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c ≤ v < add9328c91c195c494cd68a21b19e5e47a20d784, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c ≤ v < 319393151367e6626affedcdd4f7b7b0286f4246, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c ≤ v < af8a172c4f71ac30d625f2966d2389a7fa872819, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c ≤ v < 74f3c639f64fa5da4e1613149798b5089bce2807, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c ≤ v < aba30af07d4fe499b50209801eba9da8a815522f, 2.6.22 | 91acd231f219452fa58285239f83945accad9513, 7cc6b3745a0cea697c8d0684b3094f220281a08d, add9328c91c195c494cd68a21b19e5e47a20d784, 319393151367e6626affedcdd4f7b7b0286f4246, af8a172c4f71ac30d625f2966d2389a7fa872819, 74f3c639f64fa5da4e1613149798b5089bce2807, aba30af07d4fe499b50209801eba9da8a815522f |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.