CVE-2026-74641: Linux Kernel ALSA usx2y Privilege Escalation

CVE-2026-74641 Overview

CVE-2026-74641 is a Linux kernel vulnerability in the ALSA snd-usb-usx2y driver. The snd_us428ctls_vm_fault() handler converts a faulting page offset into a kernel address without validating the offset against the size of the shared region. A local user with access to the hwdep node of an attached US-X2Y device can call mmap() with an arbitrary offset and obtain read-write access to arbitrary kernel memory pages, or trigger a kernel oops when the offset resolves to an unpopulated vmemmap region. No capability check gates the operation once the FPGA image has been loaded through the same node.

Critical Impact
Local read-write access to arbitrary kernel memory pages through the snd-usb-usx2y hwdep mmap handler, enabling privilege escalation or kernel denial of service.

Affected Products

Linux kernel snd-usb-usx2y ALSA driver (multiple stable branches — see referenced commits)
Systems with an attached Tascam US-X2Y class USB audio device exposing the hwdep node
Confirmed reproducible on kernel 7.2.0-rc5 on arm64 per the vendor report

Discovery Timeline

Vulnerability discovered by XBOW, triaged by Baul Lee (baul.lee@xbow.com)
2026-08-22 - CVE-2026-74641 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74641

Vulnerability Analysis

The defect lives in snd_us428ctls_vm_fault() in the snd-usb-usx2y driver. The handler computes offset = vmf->pgoff << PAGE_SHIFT and adds it to the base address of us428ctls_sharedmem, which is a single page allocated via alloc_pages_exact(). The resulting virtual address is passed to virt_to_page() and installed into the caller's VMA read-write.

The companion snd_us428ctls_mmap() validates only the mapping length, not the offset. Because the node is a character device, file_mmap_size_max() returns ULONG_MAX, so the mm layer imposes no ceiling. Any non-zero page offset resolves to a struct page outside the intended object.

The VMA is not marked read-only, so the attacker gains write access. Offsets that resolve inside populated memory yield a usable kernel memory window; offsets outside populated vmemmap produce a paging fault and oops the kernel. The parallel handler in usx2yhwdeppcm.c computes its address the same way and requires the same bound.

Root Cause

Missing bounds check on the pgoff field of struct vm_fault before it is used as an index into a single-page shared region. This is an out-of-bounds access [CWE-125/CWE-787] in a kernel fault handler.

Attack Vector

A local user who can open the hwdep character device node of an attached US-X2Y device (typically under /dev/snd/) loads the FPGA image through the same node and then calls mmap() with a large offset. No CAP_SYS_ADMIN or equivalent check gates the fault handler, so the primitive is available to any account with device-node access.

No verified public exploit code is available. The upstream commit description contains the reproducer trace on arm64 showing snd_us428ctls_vm_fault+0x68/0x140 faulting at address fffffdffc45d5ac8. See the referenced Linux kernel commit 10a8740 for the corrective code.

Detection Methods for CVE-2026-74641

Indicators of Compromise

Kernel oops messages referencing snd_us428ctls_vm_fault or snd_usb_usx2y in dmesg or /var/log/kern.log
Unexpected mmap() calls against /dev/snd/hwC*D* nodes with large offset arguments from non-audio processes
Presence of the snd_usb_usx2y module on hosts that do not legitimately use Tascam US-X2Y hardware

Detection Strategies

Audit mmap syscalls on ALSA hwdep character devices using auditd or eBPF probes, alerting when pgoff exceeds the size of the backing shared region (one page).
Correlate snd_usb_usx2y module load events with subsequent hwdep opens from non-standard user contexts.
Monitor kernel logs for repeated paging-request oopses in ALSA fault handlers, which often indicate probing for the OOB primitive.

Monitoring Recommendations

Track loaded kernel modules and flag snd-usb-usx2y on servers, workstations, or containers with no legitimate audio-hardware use case.
Ingest kernel log and auditd telemetry into a centralized SIEM to correlate device-node access with privilege-relevant follow-on activity.
Alert on process crashes and kernel panics on systems exposing USB device passthrough, including virtualization hosts.

How to Mitigate CVE-2026-74641

Immediate Actions Required

Apply the upstream kernel patches from the referenced git.kernel.org stable commits to all affected kernel branches.
Blacklist the snd-usb-usx2y module on systems that do not require Tascam US-X2Y support using /etc/modprobe.d/.
Restrict access to /dev/snd/hwC*D* nodes through group membership and udev rules so only trusted audio users can open them.
Disable USB device passthrough to untrusted virtual machines and containers where the driver could be reached.

Patch Information

The fix rejects any mmap offset that falls outside the single-page shared region and applies the same bound to the pcm hwdep handler in usx2yhwdeppcm.c. Backports are available across stable branches in the following commits: 10a87401, 2ca1eea3, 34ab56ed, 4208db24, 5bf5ccdd, ad6fedea, f613b4a2, and f75d6f61.

Workarounds

Blacklist the vulnerable module: add blacklist snd_usb_usx2y to /etc/modprobe.d/disable-usx2y.conf and rebuild the initramfs.
Remove or physically disconnect Tascam US-X2Y USB devices from affected hosts until the kernel is patched.
Tighten permissions on ALSA hwdep device nodes via udev so only the audio group has read/write access.
On multi-tenant hosts, disable USB passthrough for untrusted workloads and enforce seccomp filters that block mmap on unexpected character devices.

bash

# Configuration example: blacklist the vulnerable module until patched
echo 'blacklist snd_usb_usx2y' | sudo tee /etc/modprobe.d/disable-usx2y.conf
sudo rmmod snd_usb_usx2y 2>/dev/null || true
sudo update-initramfs -u