CVE-2026-98741: Linux Kernel ALSA UA101 Buffer Overflow

CVE-2026-98741 Overview

CVE-2026-98741 is an out-of-bounds write vulnerability in the Linux kernel's ALSA ua101 USB audio driver (sound/usb/misc/ua101.c). The detect_usb_format() function validates bSubframeSize, bBitResolution, and tSamFreq between capture and playback interfaces, but does not cross-check wMaxPacketSize and bNrChannels between the two endpoints. A malicious or malformed USB device can declare disproportionate capture and playback packet sizes, causing the driver to write past the end of a playback URB buffer during PCM device open.

Critical Impact
A crafted USB device can trigger a slab-out-of-bounds write in kernel memory (reported by KASAN as a 2048-byte write into a 168-byte allocation), enabling heap corruption and potential local privilege escalation when the PCM node is opened.

Affected Products

Linux kernel versions containing the ua101 ALSA USB audio driver prior to the fixing commits
Systems that load snd-usb-ua101 and allow untrusted USB device connections
Distributions tracking mainline and stable kernel branches referenced by the listed stable commits

Discovery Timeline

2026-10-18 - CVE-2026-98741 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98741

Vulnerability Analysis

The ua101 driver registers a PCM node during probe and allocates playback URB buffers sized to ua->playback.max_packet_bytes. When userspace opens the playback device, start_usb_playback() and playback_work() compute the number of bytes to write into each playback URB by taking the frame count derived from the capture stream and multiplying by playback.frame_bytes. Because detect_usb_format() never relates the capture wMaxPacketSize and bNrChannels to the playback counterparts, a device that declares a large capture packet size with few capture channels and a small playback packet size with many playback channels produces a byte count that exceeds the allocated playback buffer.

The KASAN report confirms the condition: __asan_memset records a 2048-byte write into a 168-byte kmalloc-192 object at start_usb_playback (sound/usb/misc/ua101.c:586), reached through playback_pcm_open and snd_pcm_open. usb_submit_urb() later rejects the oversized iso_frame_desc[0].length with -EMSGSIZE, but the write has already corrupted adjacent slab memory.

Root Cause

The root cause is incomplete USB descriptor validation at probe time. detect_usb_format() enforces consistency on audio format fields but omits the proportionality check between the two endpoints' wMaxPacketSize and bNrChannels, allowing a mismatched descriptor pair to pass validation.

Attack Vector

An attacker with physical access or control over a USB device, including a malicious gadget emulated by tools such as raw-gadget or dummy_hcd, can present crafted interface descriptors to a vulnerable host. When any process opens the resulting PCM node, the driver triggers the out-of-bounds write. Genuine Roland UA-101 and UA-1000 hardware declares proportional packet sizes and is not affected.

No verified public code examples are available. Technical details are described in the referenced stable kernel commits.

Detection Methods for CVE-2026-98741

Indicators of Compromise

KASAN slab-out-of-bounds reports naming start_usb_playback or playback_pcm_open in sound/usb/misc/ua101.c.
usb_submit_urb() returning -EMSGSIZE from the ua101 driver immediately after a PCM open.
Unexpected kernel panics or slab corruption traces following connection of a USB audio device identifying as a UA-101 or UA-1000.

Detection Strategies

Monitor dmesg and kernel audit logs for ALSA ua101 warnings, KASAN splats, and snd-usb-ua101 probe failures.
Inventory loaded kernel modules on endpoints and flag systems where snd_usb_ua101 is present but running an unpatched kernel.
Correlate USB device attach events (udev, kernel: usb messages) with subsequent audio subsystem errors to identify suspicious devices.

Monitoring Recommendations

Enable KASAN or SLUB_DEBUG on test and canary systems that handle untrusted USB input to surface memory corruption early.
Centralize kernel logs in a SIEM and alert on BUG: KASAN and ua101 strings together.
Track USB device enumeration events on sensitive hosts to detect unexpected audio-class devices in environments where none should appear.

How to Mitigate CVE-2026-98741

Immediate Actions Required

Update the Linux kernel to a version that includes the fixing commits for the ua101 driver on all affected systems.
Blocklist the snd_usb_ua101 module on hosts that do not require Roland UA-101 or UA-1000 support by adding it to /etc/modprobe.d/.
Enforce USB device control policies to prevent attachment of untrusted USB devices on servers, workstations, and kiosks.

Patch Information

The issue is fixed by rejecting mismatched capture and playback descriptors at probe time. See the upstream stable commits: Kernel Commit 4294fe57, Kernel Commit 86f86e6f, Kernel Commit ada5ded7, Kernel Commit eb0c7fda, and Kernel Commit fd3a7bf0.

Workarounds

Prevent the vulnerable driver from loading by blacklisting snd_usb_ua101 via modprobe configuration until the kernel is patched.
Restrict physical and logical access to USB ports using USBGuard or equivalent allowlisting to deny unknown audio-class devices.
Disable PCM node access for untrusted users by tightening permissions on /dev/snd/ where feasible.

bash

# Configuration example: blacklist the vulnerable module
echo "blacklist snd_usb_ua101" | sudo tee /etc/modprobe.d/blacklist-ua101.conf
sudo depmod -a
sudo update-initramfs -u