Skip to content
Heist/ feed
High

ALSA: usb-audio: Add sanity check for OOB writes at silencing

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received packets fit with the buffer size. But when the setup in the capture stream differs from the playback stream (e.g. due to the USB core limitation of max packet size), such an inconsistency may lead to OOB writes to the buffer, resulting in a crash. For addressing it, add a sanity check of the transfer buffer size at prepare_silent_urb(), and stop the data copy if the received data overflows. Also, report back the transfer error properly from there, too. Note that this doesn't fix the root cause of the playback error itself, but this merely covers the kernel Oops.

Announced Source revision 1
Original source ↗

CVE-2026-43279

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-43279

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
        "lessThan": "fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
        "lessThan": "780dc57794a217b49994fa1d0b42465fb10a00aa",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
        "lessThan": "8995fc0e00b3fee9bf7ecb3d836b635b730c1049",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
        "lessThan": "fc9e5af60dc199051dc202ae78e1fe76a9977a5e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
        "lessThan": "6af16f1b8649df4c00d6ced924bdd8b72c885b6a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
        "lessThan": "ccaf9296763be4f76b59e2cac377006016c34435",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
        "lessThan": "fba2105a157fffcf19825e4eea498346738c9948",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "sound/usb/endpoint.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.5"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.202",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.165",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.128",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.75",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.16",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.6",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "sound/usb/endpoint.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-43279

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#40053 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement