CVE-2026-23208: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23208 Overview

CVE-2026-23208 is an out-of-bounds write vulnerability [CWE-787] in the Linux kernel's ALSA USB audio subsystem. The flaw resides in the copy_to_urb function within sound/usb/pcm.c. A local user can craft USB audio stream parameters that cause the calculated frame count to exceed the allocated USB Request Block (URB) buffer size. This triggers a slab out-of-bounds write detected by KASAN and originally reported by syzbot. The issue affects multiple kernel branches, including 6.19 release candidates and earlier stable trees.

Critical Impact
A local, low-privileged user can trigger an out-of-bounds write in kernel memory, leading to memory corruption, denial of service, or potential local privilege escalation.

Affected Products

Linux Kernel 6.19-rc1 through 6.19-rc5
Linux Kernel 4.4.229 and 4.9.229 (and additional stable branches per upstream commits)
Distributions shipping unpatched ALSA usb-audio driver builds

Discovery Timeline

2026-02-14 - CVE-2026-23208 published to the National Vulnerability Database (NVD)
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23208

Vulnerability Analysis

The vulnerability resides in the ALSA USB audio playback path. When the kernel prepares a playback URB, it allocates buffer space sized as maxpacksize * packets. The number of audio frames written into that buffer is computed independently from packsize[0] * packets. When user-supplied parameters create a mismatch between these two products, the write exceeds the allocated slab object.

In the reproducer captured by syzbot, parameters were maxpacksize=40, rate=22050, pps=1000, packsize[0]=22, and packsize[1]=23. The URB buffer size resolves to 40 * 6 = 240 bytes. The write size resolves to 22 * 12 = 264 bytes. KASAN flagged the resulting 264-byte write at offset ffff88804337e800 as a slab out-of-bounds write in copy_to_urb+0x261/0x460.

The upstream fix adds a bounds check on the per-URB frame count during frame calculation, preventing the size mismatch from reaching copy_to_urb.

Root Cause

The root cause is missing validation between the URB buffer allocation size and the frame count derived from user-controlled packet size parameters. The prepare_playback_urb routine in sound/usb/pcm.c did not enforce that the cumulative frame data fit within maxpacksize * packets bytes.

Attack Vector

Exploitation requires local access with the ability to interact with the ALSA PCM playback interface for a USB audio device. An attacker constructs hardware parameters that produce a frame count larger than the allocated URB buffer, then issues a write to the PCM stream to trigger copy_to_urb. The write corrupts adjacent slab memory.

No verified public proof-of-concept code is available beyond the syzbot KASAN report referenced in the upstream commits. See the Linux Kernel commit fixing the issue for the patch contents.

Detection Methods for CVE-2026-23208

Indicators of Compromise

KASAN log entries reporting slab-out-of-bounds in copy_to_urb within sound/usb/pcm.c
Kernel crash traces referencing prepare_playback_urb or prepare_outbound_urb in sound/usb/endpoint.c
Unexpected oops or panic events on systems with USB audio devices attached by unprivileged users

Detection Strategies

Audit running kernel versions against the fixed commits listed in the upstream advisory references
Enable KASAN on test or canary systems to surface slab out-of-bounds writes from snd-usb-audio
Correlate dmesg kernel logs for ALSA URB warnings with process activity from non-root users

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized logging pipeline for alerting on KASAN and oops signatures
Monitor for new or unusual USB audio device enumeration paired with PCM write activity from unprivileged accounts
Track loaded kernel module versions for snd-usb-audio across the fleet to identify unpatched hosts

How to Mitigate CVE-2026-23208

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor commits and reboot affected hosts
Update to a distribution kernel that incorporates the ALSA usb-audio frame count check
Restrict physical and console access on multi-user systems where USB audio attachment is not required

Patch Information

The fix is committed across multiple stable kernel branches. Patched commits include 282aba56713b, 480a1490c595, 62932d9ed639, ab0b5e92fc36, c4dc012b027c, d67dde02049e, e0ed5a36fb3a, and ef5749ef8b30. Refer to the Linux Kernel stable tree for the canonical patch.

Workarounds

Blacklist the snd-usb-audio kernel module on systems that do not require USB audio functionality
Apply udev rules to restrict USB audio device access to trusted users only
Disable ALSA PCM playback streams for untrusted local accounts where feasible

bash

# Blacklist snd-usb-audio until the patched kernel is deployed
echo 'blacklist snd_usb_audio' | sudo tee /etc/modprobe.d/disable-snd-usb-audio.conf
sudo rmmod snd_usb_audio 2>/dev/null || true
sudo update-initramfs -u