CVE-2026-74682

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5

Description An out-of-bounds write issue exists in the ALSA usb-audio component. The data ep set params() function calculates the buffer size before accounting for the Format Type II transfer delimiter. Consequently, for Type II endpoints, the allocated buffer is one packet smaller than the packet count used to build the USB Request Block (URB). When prepare inbound urb() processes the frames, the final descriptor points beyond the end of the transfer buffer, leading to an out-of-bounds write by the host controller during inbound transfers. This issue specifically affects capture operations when a device uses a Type II capture format and userspace sets hw params on the stream.

Recommendations Update the Linux kernel to version 7.2.0-rc5 or later.