CVE-2026-93808

Received Received - Intake

USB Audio CAIAQ Driver Buffer Length Validation Flaw

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes. Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-93808

EUVD

EUVD-2026-86195

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects the ALSA usb-audio caiaq driver. It involves improper validation of USB endpoint reply lengths. The function usb_ep1_command_reply_dispatch reads command-specific data from a USB buffer without verifying if the buffer contains enough data. This could lead to reading out-of-bounds memory or incorrect data processing.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA USB audio driver (caiaq). Detection requires checking kernel logs for errors related to usb-audio or caiaq, or verifying if the affected driver is loaded. Commands like 'dmesg | grep caiaq' or 'lsmod | grep snd_usb_caiaq' may help identify affected systems.

Impact Analysis

If exploited, this flaw could cause system crashes, data corruption, or unexpected behavior in systems using USB audio devices with the caiaq driver. Attackers might trigger memory corruption or denial-of-service conditions by sending maliciously crafted USB responses.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to buffer validation in USB audio device handling. Compliance impacts would only occur if exploitation led to data breaches or unauthorized access, which is not indicated by the provided details.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the affected caiaq module with 'modprobe -r snd_usb_caiaq' or restricting access to USB audio devices.

Hi! I’m here to help you understand CVE-2026-93808. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70