CVE-2026-98836: Linux Kernel ALSA Line6 Buffer Overflow

CVE-2026-98836 Overview

CVE-2026-98836 is an out-of-bounds write vulnerability in the Linux kernel's ALSA line6 USB audio driver. The flaw resides in submit_audio_out_urb() in sound/usb/line6/playback.c, where the driver fails to validate that the number of bytes written into a playback URB slice does not exceed its allocated size. A malicious or malformed USB device that declares a large IN wMaxPacketSize and a small OUT wMaxPacketSize can trigger a slab-out-of-bounds write detected by KASAN. The issue affects systems using Line 6 USB audio hardware and was resolved through kernel commits upstream.

Critical Impact
A crafted USB device can trigger a kernel heap out-of-bounds write of up to three times the allocated 256-byte slice, leading to memory corruption, kernel panic, or potential privilege escalation.

Affected Products

Linux kernel ALSA line6 USB audio driver (sound/usb/line6/playback.c)
Kernel branches prior to the fixes in commits 3f75da1, 61b0a5a, 933d8ac, a84371b, and b787484
Systems with Line 6 USB audio devices attached

Discovery Timeline

2026-10-18 - CVE-2026-98836 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98836

Vulnerability Analysis

The Linux kernel's line6 driver allocates each playback URB a slice of out.buffer sized exactly LINE6_ISO_PACKETS * max_packet_size_out bytes. The size derives from the OUT endpoint's wMaxPacketSize. The driver never compares the number of bytes written to this slice against its allocated size.

The function submit_audio_out_urb() takes its frame count from prev_fsize, a value that audio_in_callback() derives from the IN endpoint's received packet length. It then rescales that count using the playback frame size. When prev_fsize is zero, the driver synthesizes a length from the sample rate instead. On a device declaring a large IN wMaxPacketSize and a small OUT wMaxPacketSize, the resulting memcpy(), or the memset() when the playback stream is idle, runs past the slice boundary.

Root Cause

The usb_submit_urb() path provides no backstop. max_packet_size_out comes from usb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize. USB core validates a high-speed isochronous length against that base scaled by usb_endpoint_maxp_mult(). A length of up to three times the allocated slice is therefore accepted by USB core, and even a URB that is ultimately rejected is only rejected after the write has already occurred.

Attack Vector

Exploitation requires a malicious or crafted USB device impersonating a Line 6 audio product. The device declares mismatched endpoint packet sizes: a large IN wMaxPacketSize and a small OUT wMaxPacketSize. When the kernel initializes the playback stream through line6_startup_work, the driver writes a frame length derived from the IN endpoint into the smaller OUT buffer slice. KASAN confirms a write of size 1024 at an address inside a 256-byte kmalloc-256 region, demonstrating heap corruption that could be shaped into further primitives.

The fix rejects any packet that does not fit the allocated slice rather than silently clamping it, which would otherwise desynchronize the capture-derived rate feedback and the two streams. See the Kernel Git Commit 3f75da1 for the authoritative patch.

Detection Methods for CVE-2026-98836

Indicators of Compromise

KASAN reports of slab-out-of-bounds writes originating from submit_audio_out_urb in sound/usb/line6/playback.c
Kernel panics or oopses referencing line6_startup_work, line6_pcm_acquire, or line6_stream_start in the call trace
Unexpected USB device enumeration events for Line 6 vendor IDs with anomalous endpoint descriptors

Detection Strategies

Enable KASAN in test and pre-production kernels to surface slab-out-of-bounds writes in audio subsystems
Monitor dmesg and the systemd journal for BUG: KASAN entries referencing sound/usb/line6/
Audit USB device descriptors on connect, flagging devices with large asymmetries between IN and OUT wMaxPacketSize values

Monitoring Recommendations

Centralize kernel ring buffer and audit logs for correlation of USB enumeration events with kernel memory errors
Alert on new or unknown USB vendor and product IDs attached to servers, workstations, and multi-user hosts
Track package versions of kernel builds across the fleet to confirm patched versions are deployed

How to Mitigate CVE-2026-98836

Immediate Actions Required

Upgrade affected systems to a kernel version containing one of the fix commits: 3f75da1, 61b0a5a, 933d8ac, a84371b, or b787484
Restrict physical and administrative access to USB ports on sensitive hosts until the patched kernel is deployed
Disable the snd_usb_line6 module on systems that do not use Line 6 audio hardware

Patch Information

The fix rejects any playback packet whose length exceeds the slice allocated by the driver, preventing the oversized memcpy() or memset() from running past the allocation. The upstream resolution is distributed across the following commits: Kernel Git Commit 3f75da1, Kernel Git Commit 61b0a5a, Kernel Git Commit 933d8ac, Kernel Git Commit a84371b, and Kernel Git Commit b787484. Apply the vendor-provided kernel update that corresponds to your distribution's supported branch.

Workarounds

Blacklist the snd_usb_line6 kernel module on hosts that do not require Line 6 USB audio functionality
Apply USBGuard or similar USB device authorization policies to allow only trusted vendor and product IDs
Physically disconnect Line 6 USB audio devices from untrusted or shared hosts until a patched kernel is installed

bash

# Blacklist the vulnerable module until patching is complete
echo "blacklist snd_usb_line6" | sudo tee /etc/modprobe.d/blacklist-line6.conf
sudo modprobe -r snd_usb_line6

# Verify the running kernel version after patching
uname -r