CVE-2026-74641

Received Received - Intake

Memory Corruption in Linux Kernel ALSA US-X2Y Driver

Publication date: 2026-08-22

Last updated on: 2026-08-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf->pgoff << PAGE_SHIFT; vaddr = (char *)(...)->us428ctls_sharedmem + offset; page = virt_to_page(vaddr); get_page(page); vmf->page = page; return 0; snd_us428ctls_mmap() checks only the length of the mapping, never the offset, and us428ctls_sharedmem is a single page from alloc_pages_exact(). For a character device file_mmap_size_max() returns ULONG_MAX, so the mm layer imposes no ceiling either. Every page offset above zero resolves to a struct page outside the object, and the handler installs it into the caller's address space read-write; the vma is not marked read-only. The caller picks the page frame with a single mmap() argument and gets read-write access to a page of kernel memory it does not own; an offset that lands in an unpopulated vmemmap region oopses instead. A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved. On 7.2.0-rc5 (arm64), mmap() with a large offset: Unable to handle kernel paging request at virtual address fffffdffc45d5ac8 pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y] Call trace: snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y] __do_fault __handle_mm_fault handle_mm_fault el0_da Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-25

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74641

EUVD

EUVD-2026-64578

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper bounds checking in the ALSA usx2y driver. The flaw allows a process to map kernel memory into its address space by providing a large offset in an mmap() call. The driver does not validate the offset, leading to potential read-write access to unauthorized kernel memory pages.

Detection Guidance

This vulnerability affects the Linux kernel's ALSA usx2y driver. Detection involves checking if the affected driver is loaded and if the system is running a vulnerable kernel version. Commands like 'lsmod | grep snd_usb_usx2y' can check if the driver is loaded. Kernel version can be checked with 'uname -a'. If the system is running a vulnerable kernel, it may be affected.

Impact Analysis

An attacker with access to the affected device could exploit this to read or modify sensitive kernel memory, potentially leading to privilege escalation or system compromise. The vulnerability requires local access to the hwdep node of an attached US-X2Y device.

Compliance Impact

This vulnerability allows a local attacker to gain read-write access to arbitrary kernel memory pages by exploiting an unbounded mmap offset in the ALSA usx2y driver. This could lead to unauthorized data exposure or manipulation, potentially violating confidentiality and integrity requirements under GDPR and HIPAA.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security updates or kernel patches. If updating is not immediately possible, consider disabling the affected module with 'modprobe -r snd_usb_usx2y' if not in use. Restrict access to the hwdep node of US-X2Y devices to trusted users only.

Hi! I’m here to help you understand CVE-2026-74641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70