{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43279", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.998Z", "datePublished": "2026-05-06T11:29:00.844Z", "dateUpdated": "2026-08-05T12:27:01.240Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:01.240Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Add sanity check for OOB writes at silencing\n\nAt silencing the playback URB packets in the implicit fb mode before\nthe actual playback, we blindly assume that the received packets fit\nwith the buffer size. But when the setup in the capture stream\ndiffers from the playback stream (e.g. due to the USB core limitation\nof max packet size), such an inconsistency may lead to OOB writes to\nthe buffer, resulting in a crash.\n\nFor addressing it, add a sanity check of the transfer buffer size at\nprepare_silent_urb(), and stop the data copy if the received data\noverflows. Also, report back the transfer error properly from there,\ntoo.\n\nNote that this doesn't fix the root cause of the playback error\nitself, but this merely covers the kernel Oops." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is exercised through local ALSA PCM device-file operations such as open, hw_params, prepare, and trigger/write on a USB audio PCM device. It is not network reachable, but a local user can drive the stream path once a susceptible USB audio device is present.\nAC:L - There is no race or hard-to-hit timing condition; the overflow follows deterministically when implicit-feedback packet sizes exceed the playback URB buffer. A malicious or affected device plus chosen stream parameters can repeatedly drive the bad packet-size path.\nPR:L - The ALSA PCM path does not require CAP_SYS_ADMIN or another kernel capability, only permission to access the relevant /dev/snd PCM node as a normal local audio user/session. User namespaces are not needed.\nUI:N - A local attacker with PCM device access can open, configure, and start the stream directly. No separate victim action is required for that local attack path.\nS:U - The corruption occurs within the host kernel USB audio/ALSA subsystem and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds write into kernel USB transfer-buffer memory, which is kernel memory corruption. Even though the reported symptom is an oops, such corruption can plausibly be leveraged for information disclosure.\nI:H - The vulnerable code writes past the allocated URB transfer buffer while preparing silent playback packets. Out-of-bounds kernel writes are high-integrity impact because they can corrupt adjacent kernel state and potentially enable control-flow or data modification.\nA:H - The commit explicitly describes resulting kernel oops/crash behavior, and the fix only bounds the write to prevent that crash. The trigger can be repeated by starting the affected stream again." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/usb/endpoint.c" ], "versions": [ { "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f", "status": "affected", "versionType": "git" }, { "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "780dc57794a217b49994fa1d0b42465fb10a00aa", "status": "affected", "versionType": "git" }, { "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "8995fc0e00b3fee9bf7ecb3d836b635b730c1049", "status": "affected", "versionType": "git" }, { "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fc9e5af60dc199051dc202ae78e1fe76a9977a5e", "status": "affected", "versionType": "git" }, { "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "6af16f1b8649df4c00d6ced924bdd8b72c885b6a", "status": "affected", "versionType": "git" }, { "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "ccaf9296763be4f76b59e2cac377006016c34435", "status": "affected", "versionType": "git" }, { "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0", "lessThan": "fba2105a157fffcf19825e4eea498346738c9948", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/usb/endpoint.c" ], "versions": [ { "version": "3.5", "status": "affected" }, { "version": "0", "lessThan": "3.5", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.15.202" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.1.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.6.128" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.12.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.18.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.19.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f" }, { "url": "https://git.kernel.org/stable/c/780dc57794a217b49994fa1d0b42465fb10a00aa" }, { "url": "https://git.kernel.org/stable/c/8995fc0e00b3fee9bf7ecb3d836b635b730c1049" }, { "url": "https://git.kernel.org/stable/c/fc9e5af60dc199051dc202ae78e1fe76a9977a5e" }, { "url": "https://git.kernel.org/stable/c/6af16f1b8649df4c00d6ced924bdd8b72c885b6a" }, { "url": "https://git.kernel.org/stable/c/ccaf9296763be4f76b59e2cac377006016c34435" }, { "url": "https://git.kernel.org/stable/c/fba2105a157fffcf19825e4eea498346738c9948" } ], "title": "ALSA: usb-audio: Add sanity check for OOB writes at silencing", "x_generator": { "engine": "bippy-1.2.0" } } } }