CVE-2026-74500

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An information leak exists in the ALSA usb-audio component specifically affecting RME Digiface status. The function snd rme digiface read status() reads a status block into an uninitialized on-stack buffer buf[4]. When a vendor control-IN transfer results in a short read, the snd usb ctl msg() function copies the full requested size back to the caller regardless of the actual bytes delivered. This causes leftover kernel stack data to be stored in the status[] array. This data is subsequently exposed to unprivileged users reading /dev/snd/controlC* via the snd rme digiface get status val() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.