CVE-2026-23208

A heap buffer overflow vulnerability was found in the USB audio driver. When user-supplied audio parameters result in a frame count larger than the allocated URB buffer size, the copy_to_urb() function writes beyond the buffer boundary, causing an out-of-bounds write.

Exploitation requires the ability to configure USB audio device parameters, which typically needs access to the audio device. A malicious local user could potentially craft parameters to trigger the overflow. The OOB write could lead to kernel memory corruption or crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.