Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-18T00:00:00 kernel: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-787

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index into con->data[]: u8 cmd = (ctrl->bRequest & 0x0F); /* 0 .. 15 */ ... con->data[cmd] = value; /* OOB when cmd >= 5 */ struct usb_audio_control (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap. A malicious USB host can craft a class-specific SET_CUR / GET_CUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions. Add an ARRAY_SIZE() guard to both functions.

A flaw was found in the Linux kernel's Universal Serial Bus (USB) audio gadget driver. A connected USB host can send a specially crafted audio control request with an invalid command index, causing an out-of-bounds heap memory read and write. This flaw primarily allows an attacker to cause a Denial of Service (DoS) via a system crash, or potentially lead to kernel memory corruption.

This vulnerability is rated as Important because unauthenticated exploitation from an adjacent USB host could trigger out-of-bounds kernel heap corruption or a system crash. Supported Red Hat Enterprise Linux configurations are not vulnerable because the legacy USB audio gadget subsystem is not enabled in shipping kernel builds. Additionally, USB gadget functionality requires dedicated hardware running in peripheral device mode, which is not part of standard enterprise server environments. Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-98769 https://nvd.nist.gov/vuln/detail/CVE-2026-98769 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98769.mbox