CVE-2026-97929

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usbusx2y: validate URB actual length in interrupt callback

i usx2y in04 int() processes the interrupt URB data without checking urb->actual length. A short transfer from a malfunctioning device would cause the handler to process uninitialized heap data from the kmalloc-allocated in04 buf, which is then copied to the mmap-accessible ctl snapshot[] array.

Fix by using kzalloc() for in04 buf to zero-initialize the buffer, and adding an actual length check to skip processing on short transfers while still resubmitting the URB.