CVE-2026-23078: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23078 Overview

CVE-2026-23078 is a buffer overflow vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) scarlett2 driver. The flaw resides in the scarlett2_usb_get_config() function, which contains a logic error in its endianness conversion code. When the configuration retrieval loop processes more than one element, the function writes beyond the allocated buffer. The vulnerability is classified under [CWE-787] Out-of-bounds Write. It affects multiple stable Linux kernel branches, including 6.19 release candidates rc1 through rc6. A local authenticated attacker can exploit the flaw to compromise confidentiality, integrity, and availability of the host.

Critical Impact
Local exploitation of the scarlett2 driver can corrupt kernel memory, leading to privilege escalation or denial of service on systems with Focusrite Scarlett USB audio devices.

Affected Products

Linux kernel (multiple stable branches prior to fixed commits)
Linux kernel 6.19-rc1 through 6.19-rc6
Distributions shipping the ALSA scarlett2 driver

Discovery Timeline

2026-02-04 - CVE-2026-23078 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23078

Vulnerability Analysis

The scarlett2_usb_get_config() function retrieves configuration data from Focusrite Scarlett USB audio interfaces over USB. The function performs endianness conversion on the returned data before passing it to caller code. The conversion logic incorrectly compares the total buffer size against a fixed constant rather than verifying the size of each individual element. When the caller requests multiple elements, the loop iterates past the allocated buffer boundary and writes converted values into adjacent kernel memory.

Exploitation requires local access and the ability to interact with the affected USB audio driver. The resulting out-of-bounds write provides an attacker primitive that can be leveraged for kernel memory corruption.

Root Cause

The defect is a size comparison error. The code evaluates if (size == 2) where size represents the total buffer size in bytes, then iterates count times treating each element as a u16 (2 bytes). When count > 1, the loop accesses count * 2 bytes against a buffer that only contains size bytes. The fix replaces the check with config_item->size, ensuring the endianness conversion path matches the per-element type rather than the aggregate buffer length.

Attack Vector

An attacker requires local access with low privileges and the ability to trigger configuration retrieval through the scarlett2 driver. The attack does not require user interaction. Because the overflow occurs in kernel space, successful exploitation can corrupt kernel data structures and provide an avenue for local privilege escalation. Physical or virtual USB device presence may also influence reachability of the vulnerable code path.

No public proof-of-concept code is available. See the vendor patch commits for the corrected logic.

Detection Methods for CVE-2026-23078

Indicators of Compromise

Unexpected kernel oops or panic messages referencing scarlett2_usb_get_config in dmesg or journalctl -k output
KASAN (Kernel Address Sanitizer) out-of-bounds write reports in kernel logs involving the snd-usb-audio module
Anomalous USB audio device enumeration events followed by kernel memory corruption indicators

Detection Strategies

Monitor kernel ring buffer logs for stack traces involving scarlett2_usb_get_config() or adjacent ALSA USB audio symbols
Audit installed kernel versions against the fixed commits listed in the Linux stable tree
Track loading of the snd_usb_audio module on systems that do not require USB audio support

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform for correlation against privilege escalation indicators
Alert on unexpected loading of audio-related kernel modules on servers or workstations without audio hardware
Track local privilege escalation attempts following USB device insertion events

How to Mitigate CVE-2026-23078

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commit series
Update to a distribution kernel that incorporates the scarlett2 fix
Restrict local account creation and review existing low-privilege accounts on multi-user systems

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. The corrective commits include 27049f50be9f, 31a3eba5c265, 51049f6e3f05, 6f5c69f72e50, 91a756d22f04, and d5e80d1f97ae. Each commit replaces the incorrect total-buffer size check in scarlett2_usb_get_config() with a per-element config_item->size validation. Refer to the kernel.org references and apply the version appropriate to your stable branch.

Workarounds

Blacklist the snd_usb_audio module on systems that do not require Focusrite Scarlett USB audio support
Disable USB port access through hardware policy or udev rules on sensitive endpoints
Limit local shell access to trusted administrators until the patched kernel is deployed

bash

# Configuration example: blacklist the affected ALSA USB audio module
echo "blacklist snd_usb_audio" | sudo tee /etc/modprobe.d/blacklist-scarlett2.conf
sudo update-initramfs -u
sudo reboot