CVE-2026-93808

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) caiaq USB audio driver. When processing endpoint reply messages, the driver fails to validate the length of received USB data buffers before reading fixed offsets. A physically present attacker connecting a crafted USB device could exploit this flaw to cause an out-of-bounds memory read, leading to a system crash and Denial of Service (DoS).

A moderate-impact out-of-bounds read flaw was found in the Linux kernel's ALSA caiaq USB audio driver. The usb_ep1_command_reply_dispatch() function reads command-specific items at fixed offsets (such as buf + 1, buf[1], buf[2], or buf + 3) from the endpoint 1 (EP1) URB reply buffer without first verifying that urb->actual_length actually contains those bytes. A physically present attacker connecting a crafted (or compromised) supported USB audio device could send truncated EP1 replies, causing the driver to read beyond the received payload, which can result in a kernel crash and denial of service. Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires physical access to plug in a malicious USB device, and the primary impact is loss of availability; the flaw does not provide a demonstrated mechanism for disclosure of sensitive data or for memory corruption. The kernel and kernel-rt packages in Red Hat Enterprise Linux, the Red Hat In-Vehicle OS kernels, and the OpenShift RHEL CoreOS images listed in this flaw are affected. Fixes for these affected streams are currently deferred, so the residual risk remains that a physically present attacker could trigger a local denial of service through a malicious USB device until updated packages are delivered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.