All vulnerabilities
CVE-2026-97929

Linux: ALSA: usbusx2y: validate URB actual_length in interrupt callback

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2770321b358658e0a39fe39ccf6a91ee97a81931Also 8f5ef203abda9dd36b2af473c7b737d544f807bdCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 2770321b358658e0a39fe39ccf6a91ee97a81931LinuxCVE List
  • 8f5ef203abda9dd36b2af473c7b737d544f807bdLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usbusx2y: validate URB actual_length in interrupt callback

i_usx2y_in04_int() processes the interrupt URB data without checking urb->actual_length. A short transfer from a malfunctioning device would cause the handler to process uninitialized heap data from the kmalloc-allocated in04_buf, which is then copied to the mmap-accessible ctl_snapshot[] array.

Fix by using kzalloc() for in04_buf to zero-initialize the buffer, and adding an actual_length check to skip processing on short transfers while still resubmitting the URB.

Text from CVE List

Affected versions 12

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c3576cb77b527f223cf2b9fc2b2e9af5e7adee25CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c156584999bf15118f523ef6c6fedc5b21f46bd9CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7dCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2770321b358658e0a39fe39ccf6a91ee97a81931CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8f5ef203abda9dd36b2af473c7b737d544f807bdCVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5