CVE-2026-74498
Description
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio subsystem. When a USB audio endpoint requests full packet transfers using the fill_max descriptor flag, the system allocates an undersized Direct Memory Access (DMA) buffer. This allows a malicious USB device to write data beyond the buffer's boundaries, corrupting kernel heap memory. This memory corruption can lead to a system crash (Denial of Service) or potentially enable an attacker to execute arbitrary code with elevated privileges.
Statement
A DMA out of bounds write in the ALSA USB audio path can occur when a USB audio endpoint sets the fill_max flag. data_ep_set_params promotes curpacksize to maxpacksize, but the DMA buffer can still be allocated using the smaller sample rate derived maxsize. A malicious USB audio device can therefore cause the host controller to write past the end of the allocated buffer and corrupt kernel heap memory during streaming. For the CVSS the PR:N because no privileges on the victim system are required beyond the ability to present a crafted USB audio device. The base score uses UI:R because a victim action such as connecting or using the device may be needed in common scenarios. The paranoid score uses UI:N and CIA:HHH because the patch context shows a concrete kernel heap out of bounds write primitive, not only a crash. Impact is at least denial of service and may include privilege escalation or broader confidentiality and integrity impact through memory corruption.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.6 | N/A | N/A |
| Attack Vector | Physical | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
