CVE-2026-97930

A flaw was found in the Linux kernel's ALSA usbusx2y driver. Due to an array size mismatch during device initialization, the driver performs an out-of-bounds read by copying more data than allocated for an internal buffer. An attacker capable of connecting a crafted USB device can exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system or potentially disclose sensitive kernel memory.

A moderate-impact out-of-bounds read flaw was found in the Linux kernel's ALSA usbusx2y USB audio driver, affecting the kernel packages in Red Hat Enterprise Linux (including kernel-rt), Red Hat In-Vehicle OS, and the RHEL CoreOS 8 and 9 images used by OpenShift Container Platform. During device initialization, i_usx2y_in04_int() copies 24 bytes from the 21-byte in04_buf allocation into the in04_last array, reading 3 bytes past the end of the source object. An attacker who is able to connect a crafted USB device to the system could use this flaw to cause a denial of service by crashing the kernel; while the over-read can in principle expose adjacent kernel memory, the extra bytes are copied into an internal array that is not exposed to userspace, so no reliable information disclosure has been demonstrated. The issue has existed since the driver was introduced in Linux 2.6.12. The fix is deferred for the affected Red Hat streams because exploitation requires physical access to attach a malicious USB device and the practical impact is limited to system availability; the residual risk is a local denial of service on machines where an attacker can connect such a device, and the fix will be delivered in a future scheduled kernel update.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.