All vulnerabilities
CVE-2026-93808

Linux: ALSA: usb-audio: caiaq: validate EP1 reply lengths

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in91acd231f219452fa58285239f83945accad9513Also 7cc6b3745a0cea697c8d0684b3094f220281a08d, 319393151367e6626affedcdd4f7b7b0286f4246 and 1 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 91acd231f219452fa58285239f83945accad9513LinuxCVE List
  • 7cc6b3745a0cea697c8d0684b3094f220281a08dLinuxCVE List
  • 319393151367e6626affedcdd4f7b7b0286f4246LinuxCVE List
  • 74f3c639f64fa5da4e1613149798b5089bce2807LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: caiaq: validate EP1 reply lengths

usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes.

Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.

Text from CVE List

Affected versions 16

  • Linuxaffected: 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before 91acd231f219452fa58285239f83945accad9513CVE List
  • Linuxaffected: 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before 7cc6b3745a0cea697c8d0684b3094f220281a08dCVE List
  • Linuxaffected: 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before add9328c91c195c494cd68a21b19e5e47a20d784CVE List
  • Linuxaffected: 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before 319393151367e6626affedcdd4f7b7b0286f4246CVE List
  • Linuxaffected: 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before af8a172c4f71ac30d625f2966d2389a7fa872819CVE List
  • Linuxaffected: 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before 74f3c639f64fa5da4e1613149798b5089bce2807CVE List
  • Linuxaffected: 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before aba30af07d4fe499b50209801eba9da8a815522fCVE List
  • Linuxaffected: 2.6.22CVE List
  • Linuxunaffected: all versions before 2.6.22CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7