CVE-2026-98741

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ua101: reject mismatched capture/playback packet sizes

detect usb format() cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize and bNrChannels. Each playback URB gets a buffer of ua->playback.max packet bytes, while the number of bytes written into it is derived from the capture stream: capture urb complete() computes frames from the received capture packet and capture.frame bytes, and start usb playback() and playback work() multiply that by playback.frame bytes.

A device declaring a large capture wMaxPacketSize with few capture channels and a small playback wMaxPacketSize with many playback channels therefore memset()s and memcpy()s past the end of the playback buffer, in open() of the PCM node the driver registers during probe. usb submit urb() rejects the over-long iso frame desc[0].length with -EMSGSIZE, but only after the write.

Reject such descriptors at probe time. Genuine UA-101/UA-1000 hardware declares proportional packet sizes and is unaffected.

BUG: KASAN: slab-out-of-bounds in start usb playback (sound/usb/misc/ua101.c:586) Write of size 2048 at addr ffff8881098f3c00 by task exploit/5021 Call Trace: asan memset (mm/kasan/shadow.c:84) start usb playback (sound/usb/misc/ua101.c:586) playback pcm open (sound/usb/misc/ua101.c:679) snd pcm open substream (sound/core/pcm native.c:2829) snd pcm open (sound/core/pcm native.c:2865 sound/core/pcm native.c:2932) snd pcm playback open (sound/core/pcm native.c:2891) snd open (sound/core/sound.c:166) chrdev open (fs/char dev.c:411) do dentry open (fs/open.c:996) vfs open (fs/open.c:1101) path openat (fs/namei.c:4837 fs/namei.c:5000) do file open (fs/namei.c:5029) do sys openat2 (fs/open.c:1417) x64 sys openat (fs/open.c:1423 fs/open.c:1439 fs/open.c:1434) do syscall 64 (arch/x86/entry/syscall 64.c:61 arch/x86/entry/syscall 64.c:84) entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:121)

The buggy address belongs to the object at ffff8881098f3c00 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes inside of allocated 168-byte region [ffff8881098f3c00, ffff8881098f3ca8)