{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-98741", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-98741", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-10-18T15:47:26.283Z", "updatedAt": "2026-10-21T12:56:16.734Z", "importedAt": "2026-10-24T01:58:41.756Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "ALSA: ua101: reject mismatched capture/playback packet sizes", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ua101: reject mismatched capture/playback packet sizes\n\ndetect_usb_format() cross-checks bSubframeSize, bBitResolution and\ntSamFreq between the capture and playback interfaces, but never relates\nthe two endpoints' wMaxPacketSize and bNrChannels. Each playback URB\ngets a buffer of ua->playback.max_packet_bytes, while the number of\nbytes written into it is derived from the capture stream:\ncapture_urb_complete() computes frames from the received capture packet\nand capture.frame_bytes, and start_usb_playback() and playback_work()\nmultiply that by playback.frame_bytes.\n\nA device declaring a large capture wMaxPacketSize with few capture\nchannels and a small playback wMaxPacketSize with many playback channels\ntherefore memset()s and memcpy()s past the end of the playback buffer,\nin open() of the PCM node the driver registers during probe.\nusb_submit_urb() rejects the over-long iso_frame_desc[0].length with\n-EMSGSIZE, but only after the write.\n\nReject such descriptors at probe time. Genuine UA-101/UA-1000 hardware\ndeclares proportional packet sizes and is unaffected.\n\n BUG: KASAN: slab-out-of-bounds in start_usb_playback (sound/usb/misc/ua101.c:586)\n Write of size 2048 at addr ffff8881098f3c00 by task exploit/5021\n Call Trace:\n __asan_memset (mm/kasan/shadow.c:84)\n start_usb_playback (sound/usb/misc/ua101.c:586)\n playback_pcm_open (sound/usb/misc/ua101.c:679)\n snd_pcm_open_substream (sound/core/pcm_native.c:2829)\n snd_pcm_open (sound/core/pcm_native.c:2865 sound/core/pcm_native.c:2932)\n snd_pcm_playback_open (sound/core/pcm_native.c:2891)\n snd_open (sound/core/sound.c:166)\n chrdev_open (fs/char_dev.c:411)\n do_dentry_open (fs/open.c:996)\n vfs_open (fs/open.c:1101)\n path_openat (fs/namei.c:4837 fs/namei.c:5000)\n do_file_open (fs/namei.c:5029)\n do_sys_openat2 (fs/open.c:1417)\n __x64_sys_openat (fs/open.c:1423 fs/open.c:1439 fs/open.c:1434)\n do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n The buggy address belongs to the object at ffff8881098f3c00\n which belongs to the cache kmalloc-192 of size 192\n The buggy address is located 0 bytes inside of\n allocated 168-byte region [ffff8881098f3c00, ffff8881098f3ca8)", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "63978ab3e3e963db28093b53bb4598f2702e1ad7", "status": "affected", "versionType": "git", "lessThan": "ada5ded765f059a6e3036e69ca350449442af0fc" }, { "version": "63978ab3e3e963db28093b53bb4598f2702e1ad7", "status": "affected", "versionType": "git", "lessThan": "fd3a7bf0d988b0878a1957df150edb35f81db87e" }, { "version": "63978ab3e3e963db28093b53bb4598f2702e1ad7", "status": "affected", "versionType": "git", "lessThan": "eb0c7fda59cf650076f8ed5b949a6c8441aa3606" }, { "version": "63978ab3e3e963db28093b53bb4598f2702e1ad7", "status": "affected", "versionType": "git", "lessThan": "4294fe57048594a9e158b61c967bb7f943cda477" }, { "version": "63978ab3e3e963db28093b53bb4598f2702e1ad7", "status": "affected", "versionType": "git", "lessThan": "86f86e6fdedc33c5b8d38b9208b350f8accf57ee" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "2.6.34", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "2.6.34" }, { "version": "6.6.160", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.113", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.56", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.2.10", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.2.*" }, { "version": "7.3", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }