CVE-2026-74498

Received Received - Intake

Buffer Overflow in Linux Kernel USB Audio Driver

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set When a USB audio endpoint requests full packet transfers via the fill_max descriptor flag, data_ep_set_params() promotes ep->curpacksize to ep->maxpacksize. However, maxsize is left at the original sample-rate derived value. Since u->buffer_size is allocated as maxsize * packets, the resulting DMA buffer is far too small for the requested transfer length. When the USB host controller streams up to curpacksize bytes per packet, it writes past the end of the buffer via DMA, corrupting kernel heap memory. Update maxsize to curpacksize when fill_max is set so that the allocated DMA buffer size matches the actual transfer request size. [ changed to reassign maxsize only when ep->fill_max is set -- tiwai ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74498

EUVD

EUVD-2026-59691

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's USB audio driver. When a USB audio device requests full packet transfers, the kernel incorrectly calculates the DMA buffer size. The buffer is too small, causing the USB host controller to write past its end and corrupt kernel memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB audio driver and requires kernel-level inspection. Detection involves checking kernel logs for DMA buffer overflow errors or examining the USB audio driver code for the fill_max flag usage. No direct network detection commands are applicable.

Impact Analysis

This could allow an attacker with physical access to a vulnerable system to cause memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It may also enable denial-of-service attacks by destabilizing the system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel DMA buffer overflow in USB audio handling. Compliance impacts would depend on system-specific usage and data exposure, which is not detailed in the provided CVE information.

Mitigation Strategies

Apply the Linux kernel patch that updates the USB audio driver to set maxsize to curpacksize when fill_max is set. Update to a kernel version containing the fix (e.g., 6.6.1 or later). Monitor kernel logs for DMA buffer overflow errors as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-74498. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70