CVE-2026-74682: Linux Kernel ALSA USB Audio Buffer Overflow

CVE-2026-74682 Overview

CVE-2026-74682 is an out-of-bounds write vulnerability in the Linux kernel's ALSA USB audio driver. The flaw resides in data_ep_set_params() within the USB audio subsystem, where the transfer buffer size is computed before a Format Type II transfer delimiter packet is appended. As a result, USB Request Blocks (URBs) for Type II capture endpoints are constructed with one more packet than the allocated buffer can hold. The host controller writes device data past the end of the allocated slab region during every inbound transfer, triggering slab-out-of-bounds writes detected by KASAN. The issue affects any device that advertises a UAC Type II capture format once userspace configures hw_params on the stream.

Critical Impact
A malicious or malformed USB audio device advertising a UAC Type II capture format can trigger repeated kernel heap out-of-bounds writes, corrupting adjacent slab memory on every inbound isochronous transfer.

Affected Products

Linux kernel ALSA snd-usb-audio driver
Kernel builds prior to the fix commits referenced in stable trees
Systems processing USB Audio Class Type II capture streams

Discovery Timeline

Vulnerability discovered by XBOW, triaged by Baul Lee (baul.lee@xbow.com)
2026-08-22 - CVE-2026-74682 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74682

Vulnerability Analysis

The defect is a classic Out-of-Bounds Write [CWE-787] rooted in an ordering mistake between buffer sizing and packet counting. In data_ep_set_params(), the driver first sets u->packets = urb_packs and computes u->buffer_size = maxsize * u->packets. Only afterward does it increment u->packets by one to reserve room for the Format Type II transfer delimiter, then allocates the URB with usb_alloc_urb(u->packets, GFP_KERNEL). The transfer buffer is therefore one maxsize packet short of the packet count the URB will carry.

prepare_inbound_urb() compounds the problem by iterating urb_ctx->packets iso frame descriptors without consulting buffer_size. Each descriptor is assigned an offset of i * ep->curpacksize, so the final descriptor points one packet past the allocation boundary. Because inbound URBs receive device-controlled data written by the host controller, every capture transfer produces a write beyond the slab object. prepare_silent_urb() and prepare_playback_urb() bound their fill loops by ctx->buffer_size, so only the capture path is affected.

Root Cause

The root cause is a stale buffer_size value cached before the Type II delimiter packet is accounted for. The size is never recomputed after u->packets++, breaking the invariant that buffer_size equals maxsize * packets.

Attack Vector

Exploitation requires a USB device (or a virtualized gadget such as dummy_hcd/raw-gadget) that advertises UAC_FORMAT_TYPE_II in its audio streaming descriptors. When userspace sets hw_params on the associated capture stream, the driver allocates the undersized buffer, and each subsequent inbound isochronous transfer writes attacker-influenced audio data past the end of a 64-byte slab region. KASAN on kernel 7.2.0-rc5 (arm64) reports a slab-out-of-bounds write of 64 bytes in dummy_timer following allocation by snd_usb_endpoint_set_params via usb_alloc_coherent.

No verified public exploit code is available. See the referenced kernel stable commits for the corrective patch that computes buffer_size after the delimiter packet is accounted for and bounds the fill loop by buffer_size.

Detection Methods for CVE-2026-74682

Indicators of Compromise

KASAN reports of slab-out-of-bounds writes originating from dummy_timer or USB host controller callbacks with allocations traced to snd_usb_endpoint_set_params.
Kernel oops or slab corruption warnings correlated with USB audio device enumeration and snd_pcm_hw_params calls on capture streams.
Presence of USB devices advertising UAC_FORMAT_TYPE_II capture endpoints, particularly untrusted or synthetic USB gadgets.

Detection Strategies

Enable KASAN and USB debug logging on test kernels to surface out-of-bounds writes during USB audio device attachment.
Audit dmesg for snd-usb-audio messages accompanied by memory corruption warnings shortly after USB device connection events.
Correlate udev USB attach events with subsequent kernel instability, focusing on devices exposing audio streaming interfaces.

Monitoring Recommendations

Track kernel package versions across Linux fleets to confirm the ALSA USB audio patch is applied in stable, longterm, and distribution kernels.
Alert on unexpected USB device attachments on servers, kiosks, and other systems where USB audio devices are not operationally required.
Log kernel ring buffer output centrally to identify slab corruption patterns that may precede exploitation or system compromise.

How to Mitigate CVE-2026-74682

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits, including 6af5f29 and the associated backports.
Rebuild and redeploy kernels for distributions that maintain private trees, ensuring the fix reaches all longterm branches in production.
Restrict physical and virtual USB attachment on multi-user or exposed systems until patched kernels are deployed.

Patch Information

The fix moves the buffer_size calculation after the Type II delimiter packet increment and bounds the inbound URB fill loop by buffer_size, mirroring the safeguard already present in prepare_silent_urb(). Every Type II URB allocation grows by one maxsize packet. Corresponding stable commits: 0a23537, 137bf03, 6607f85, 69ee44e, 6af5f29, ca22c94, d3ed4e6, and f1fbb50.

Workarounds

Blacklist the snd-usb-audio module on systems that do not require USB audio functionality using modprobe configuration.
Use USB device authorization policies to deny audio class devices at the udev layer until the kernel patch is applied.
Disable USB ports through BIOS/UEFI settings or physical port controls on systems where external USB devices are not needed.