CVE-2026-74682

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write on Type II inbound URBs

data_ep_set_params() sizes each URB transfer buffer before it adds the

Format Type II transfer delimiter:

u->packets = urb_packs;

u->buffer_size = maxsize * u->packets;

if (fmt->fmt_type == UAC_FORMAT_TYPE_II)

u->packets++; /* for transfer delimiter */

u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);

buffer_size is computed from the pre-increment packet count and never

recomputed, so for a Type II endpoint the buffer is one packet short of

the packet count the URB is built with.

prepare_inbound_urb() then lays out one iso frame per packet and never

consults buffer_size:

offs = 0;

for (i = 0; i < urb_ctx->packets; i++) {

urb->iso_frame_desc[i].offset = offs;

urb->iso_frame_desc[i].length = ep->curpacksize;

offs += ep->curpacksize;

}

urb->transfer_buffer_length = offs;

urb->number_of_packets = urb_ctx->packets;

The last descriptor therefore p

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References