CVE-2026-74498

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write occurs in the ALSA usb-audio component when the fill max descriptor flag is set. The data ep set params() function promotes ep->curpacksize to ep->maxpacksize, but the maxsize variable remains at the original value derived from the sample rate. Because u->buffer size is allocated based on maxsize multiplied by packets, the resulting Direct Memory Access (DMA) buffer is insufficient for the requested transfer length. Consequently, when the USB host controller streams data up to curpacksize bytes per packet, it writes beyond the buffer boundary via DMA, leading to kernel heap memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.