CVE-2026-98265

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity

data_ep_set_params() allocates each data URB for exactly u->packets

isochronous frames, so urb->iso_frame_desc[] has u->packets slots and

ctx->packets is the driver's only record of that limit. For an implicit

feedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the

sync source's packet count, which is calculated independently from the

capture endpoint's parameters. When that count is larger,

prepare_playback_urb() and prepare_silent_urb() can write

iso_frame_desc[] past the allocation; their existing bounds limit payload

bytes, not the descriptor index.

The reproducer uses a high-speed UAC2 device declaring bInterval 1 for

implicit feedback capture (8 packets) and bInterval 4 for playback

(1 packet). On the first capture completion after the stream starts, it

accesses seven descriptors spanning 112 bytes beyond the one-packet URB

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References