CVE-2026-74500

Received Received - Intake

Stack Info Leak in Linux Kernel ALSA USB Audio

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd_rme_digiface_read_status() reads a four-word status block from the device into an uninitialised on-stack __le32 buf[4] and, whenever the vendor control-IN transfer does not return a negative error, copies all four words into the caller's status[]. snd_usb_ctl_msg() copies the full requested size back into the caller's buffer regardless of how many bytes the data stage actually delivered: buf = kmemdup(data, size, GFP_KERNEL); err = usb_control_msg(dev, pipe, request, requesttype, value, index, buf, size, timeout); memcpy(data, buf, size); usb_control_msg() returns the transferred length on a short control-IN, which is a non-negative value, and writes only that many bytes. The remainder of the copy back is the kmemdup()ed image of the caller's buffer, so a device answering with a short data stage leaves the trailing words of buf[] holding leftover kernel stack. The only guard in the caller is err < 0, so those words are stored into status[]. They then reach user space: snd_rme_digiface_get_status_val() selects a 16-bit halfword of status[] per the control's reg/mask, and the eight Digiface status controls together expose the whole 16-byte frame to an unprivileged reader of /dev/snd/controlC*. Zero-initialise the buffer so a short read yields zeros instead of stack residue. This mirrors snd_rme_get_status1(), which already clears its output word before the same kind of vendor read. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74500

EUVD

EUVD-2026-59693

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a stack information leak in the Linux kernel's ALSA USB-audio driver for RME Digiface devices. It occurs when reading status from the device, where uninitialized stack memory is copied to user space if the device returns a short read. The issue arises because the buffer is not zero-initialized before use, exposing leftover kernel stack data to unprivileged users via /dev/snd/controlC*.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA USB-audio driver for RME Digiface devices. Detection requires checking the kernel version and the presence of the affected driver. Use commands like 'uname -a' to check kernel version and 'lsmod | grep snd_usb_audio' to verify if the driver is loaded.

Impact Analysis

An attacker with local access could exploit this to read sensitive kernel stack memory, potentially exposing confidential information such as cryptographic keys, passwords, or other sensitive data processed by the kernel. This could lead to further exploitation or information disclosure.

Compliance Impact

This vulnerability involves a stack information leak in the Linux kernel's ALSA USB audio driver, exposing uninitialized kernel memory to user space. While it does not directly impact GDPR or HIPAA compliance, such information leaks could potentially lead to unauthorized data exposure if exploited, which may violate data protection principles under these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. If using a distribution kernel, apply updates from your vendor. For custom kernels, ensure the patch for 'ALSA: usb-audio: fix stack info leak in RME Digiface status' is applied.

Hi! I’m here to help you understand CVE-2026-74500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70