CVE-2026-97929

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio driver. This vulnerability can lead to information disclosure when communicating with an attached USB device. The driver fails to verify the length of incoming data transfers during interrupt handling, allowing uninitialized kernel memory to be copied into memory buffers accessible by user applications. An attacker who connects a crafted or malfunctioning USB device can exploit this issue to expose sensitive kernel information to local users.

A moderate-severity information disclosure flaw was found in the Linux kernel's ALSA usbusx2y USB audio driver. The interrupt endpoint callback i_usx2y_in04_int() processes incoming URB data without validating urb->actual_length, so when a crafted or malfunctioning USB device delivers a short transfer, the handler processes uninitialized heap memory from the kmalloc-allocated in04_buf and copies it into the mmap-accessible ctl_snapshot[] array. A local user with access to the affected ALSA device's mapped control interface can consequently read residual kernel heap data; the flaw does not affect integrity and does not grant privilege escalation or code execution. The affected scope covers Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), and the RHEL CoreOS 8/9 content shipped with OpenShift Container Platform 4, with Red Hat Enterprise Linux 6 Extended Lifecycle Support additionally in scope but out of active support. For the in-support affected streams the fix is deferred to a future regularly scheduled kernel update because this issue does not currently warrant an out-of-cycle update; the residual risk is limited since exploitation requires a crafted or malfunctioning USB device to be physically attached to the system together with a local user able to access the ALSA mmap interface, and the exposure is confined to uninitialized kernel heap memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.