CVE-2026-74498

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio subsystem. When a USB audio endpoint requests full packet transfers using the fill_max descriptor flag, the system allocates an undersized Direct Memory Access (DMA) buffer. This allows a malicious USB device to write data beyond the buffer's boundaries, corrupting kernel heap memory. This memory corruption can lead to a system crash (Denial of Service) or potentially enable an attacker to execute arbitrary code with elevated privileges.

A DMA out of bounds write in the ALSA USB audio path can occur when a USB audio endpoint sets the fill_max flag. data_ep_set_params promotes curpacksize to maxpacksize, but the DMA buffer can still be allocated using the smaller sample rate derived maxsize. A malicious USB audio device can therefore cause the host controller to write past the end of the allocated buffer and corrupt kernel heap memory during streaming. For the CVSS the PR:N because no privileges on the victim system are required beyond the ability to present a crafted USB audio device. The base score uses UI:R because a victim action such as connecting or using the device may be needed in common scenarios. The paranoid score uses UI:N and CIA:HHH because the patch context shows a concrete kernel heap out of bounds write primitive, not only a crash. Impact is at least denial of service and may include privilege escalation or broader confidentiality and integrity impact through memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.