CVE-2026-74682

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio driver. This vulnerability involves an out-of-bounds write, where the system attempts to write data beyond the allocated memory buffer. This occurs due to incorrect buffer sizing when processing data from certain USB audio devices. A local attacker, by connecting a malicious USB audio device, could exploit this to cause memory corruption, potentially leading to system instability or information disclosure.

A device controlled OOB write exists in the ALSA usb-audio Type II capture path because buffer_size is computed before the extra transfer delimiter packet is added. When prepare_inbound_urb builds iso frame descriptors, the final descriptor can point one packet past the allocated transfer buffer and the USB host controller writes inbound device data there on each transfer. For the CVSS the PR:N is used because the malicious USB device does not need host privileges once it can be attached and the capture stream is opened. The issue is not network reachable and normally requires physical USB access or an equivalent USB device emulation path. Impact is at least denial of service via kernel memory corruption. In the paranoid score, confidentiality and integrity are rated high because this is a real OOB write primitive with device supplied data, even though reliable privilege escalation is not proven from the patch alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.