CVE-2026-74497

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio subsystem. A connected USB device could send oversized synchronization packets, causing the system to process data beyond its hardware limits. This could lead to a denial of service (DoS) or system instability.

An oversized implicit feedback sync packet from a connected USB audio device can make snd_usb_handle_sync_urb() calculate a frame count larger than ep maxframesize. That unbounded frame count is stored in out_packet packet_size and can later enter the playback endpoint queue, potentially causing transfers beyond the endpoint hardware frame limit. For the CVSS the PR:N because the attacker only needs control of a connected USB audio device and does not need a local user account on the victim system. The issue is not network reachable and requires physical or device level access. Impact is at least denial of service through broken USB audio transfer handling or a kernel fault. For the paranoid score, limited confidentiality or integrity impact is kept because the bug is an unchecked size propagation into transfer sizing logic, but the patch does not prove a reliable privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.