{"id":"CVE-2026-98741","kind":"vulnerability","aliases":["CVE-2026-98741"],"related":[],"title":"Linux kernel: malformed USB audio device can overwrite kernel memory on open","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ua101: reject mismatched capture/playback packet sizes\n\ndetect_usb_format() cross-checks bSubframeSize, bBitResolution and\ntSamFreq between the capture and playback interfaces, but never relates\nthe two endpoints' wMaxPacketSize and bNrChannels.  Each playback URB\ngets a buffer of ua->playback.max_packet_bytes, while the number of\nbytes written into it is derived from the capture stream:\ncapture_urb_complete() computes frames from the received capture packet\nand capture.frame_bytes, and start_usb_playback() and playback_work()\nmultiply that by playback.frame_bytes.\n\nA device declaring a large capture wMaxPacketSize with few capture\nchannels and a small playback wMaxPacketSize with many playback channels\ntherefore memset()s and memcpy()s past the end of the playback buffer,\nin open() of the PCM node the driver registers during probe.\nusb_submit_urb() rejects the over-long iso_frame_desc[0].length with\n-EMSGSIZE, but only after the write.\n\nReject such descriptors at probe time.  Genuine UA-101/UA-1000 hardware\ndeclares proportional packet sizes and is unaffected.\n\n  BUG: KASAN: slab-out-of-bounds in start_usb_playback (sound/usb/misc/ua101.c:586)\n  Write of size 2048 at addr ffff8881098f3c00 by task exploit/5021\n  Call Trace:\n   __asan_memset (mm/kasan/shadow.c:84)\n   start_usb_playback (sound/usb/misc/ua101.c:586)\n   playback_pcm_open (sound/usb/misc/ua101.c:679)\n   snd_pcm_open_substream (sound/core/pcm_native.c:2829)\n   snd_pcm_open (sound/core/pcm_native.c:2865 sound/core/pcm_native.c:2932)\n   snd_pcm_playback_open (sound/core/pcm_native.c:2891)\n   snd_open (sound/core/sound.c:166)\n   chrdev_open (fs/char_dev.c:411)\n   do_dentry_open (fs/open.c:996)\n   vfs_open (fs/open.c:1101)\n   path_openat (fs/namei.c:4837 fs/namei.c:5000)\n   do_file_open (fs/namei.c:5029)\n   do_sys_openat2 (fs/open.c:1417)\n   __x64_sys_openat (fs/open.c:1423 fs/open.c:1439 fs/open.c:1434)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n  The buggy address belongs to the object at ffff8881098f3c00\n   which belongs to the cache kmalloc-192 of size 192\n  The buggy address is located 0 bytes inside of\n   allocated 168-byte region [ffff8881098f3c00, ffff8881098f3ca8)","summary":"The Linux kernel's ua101 USB audio driver accepts a device whose capture and playback endpoints declare mismatched packet sizes and channel counts, so opening the playback PCM node writes past a heap buffer. An attacker who can plug in or emulate such a USB device can corrupt kernel memory, which can lead to a crash or privilege escalation.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","usb-audio","workstations"],"not_affected_if":["driver-not-built","no-ua101-hardware","no-untrusted-usb"],"how_to_check":"- Check whether the kernel includes the ua101 driver: `grep -i ua101 /boot/config-$(uname -r)` (CONFIG_SND_USB_UA101 set to m or y)\n- Check the running kernel version: `uname -r`\n- Check for the ua101 module loaded: `lsmod | grep snd_ua101`","fix":"- Update the Linux kernel to a release that includes the upstream commit 'ALSA: ua101: reject mismatched capture/playback packet sizes' (exact fixed version: unknown)\n- Until patched, blacklist the module if no UA-101 or UA-1000 hardware is used: `echo 'blacklist snd_ua101' > /etc/modprobe.d/ua101.conf`","status":"open","published_at":"2026-10-18T16:17:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:06+00:00","updated_at":"2026-10-25T05:17:06+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:17:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'ALSA: ua101: reject mismatched capture/playback packet sizes' (exact fixed version: unknown)\n- Until patched, blacklist the module if no UA-101 or UA-1000 hardware is used: `echo 'blacklist snd_ua101' > /etc/modprobe.d/ua101.conf`","reach":"local","title":"Linux kernel: malformed USB audio device can overwrite kernel memory on open","impact":"high","summary":"The Linux kernel's ua101 USB audio driver accepts a device whose capture and playback endpoints declare mismatched packet sizes and channel counts, so opening the playback PCM node writes past a heap buffer. An attacker who can plug in or emulate such a USB device can corrupt kernel memory, which can lead to a crash or privilege escalation.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","usb-audio","workstations"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel memory corruption from a malicious USB device, possibly root","analyst_note":"Find the fixed kernel version and stable backport commit in the kernel git history for the ua101 patch; the sources given do not list a version.","how_to_check":"- Check whether the kernel includes the ua101 driver: `grep -i ua101 /boot/config-$(uname -r)` (CONFIG_SND_USB_UA101 set to m or y)\n- Check the running kernel version: `uname -r`\n- Check for the ua101 module loaded: `lsmod | grep snd_ua101`","needs_analyst":true,"not_affected_if":["driver-not-built","no-untrusted-usb","no-ua101-hardware"],"who_is_affected":"Systems running a Linux kernel with the ua101 USB audio driver enabled, which is mainly used for Edirol/Roland UA-101 and UA-1000 interfaces. The flaw needs a USB device that declares inconsistent packet sizes, so exposure is mostly on machines where untrusted USB devices can be attached. Hosts without this driver or without untrusted USB access can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000821,"input_tokens":4289,"output_tokens":784,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-101':250C '-192':389C '-2026':14A,17A '-98741':15A,18A '/ua-1000':251C '0':233C,398C '1101':334C '121':373C '1417':350C '1423':355C '1434':359C '1439':357C '166':321C '168':403C '192':392C '2048':276C '2829':304C '2865':309C '2891':317C '2932':311C '411':325C '4837':338C '5000':340C '5029':345C '586':272C,293C '61':364C '64':362C,369C '679':298C '84':288C,366C '996':330C 'accept':35B 'addr':278C 'address':376C,395C 'alloc':402C 'alsa':96C 'arch/x86/entry/entry_64.s':372C 'arch/x86/entry/syscall_64.c':363C,365C 'asan':285C 'attack':62B 'audio':5A,25B,33B 'bbitresolut':110C 'belong':377C,384C 'bnrchannel':127C 'bound':266C 'bsubframes':109C 'buffer':60B,133C,210C 'bug':260C 'buggi':375C,394C 'byte':138C,143C,165C,177C,399C,404C 'cach':387C 'call':283C 'captur':39B,115C,151C,153C,161C,183C,187C 'capture.frame':164C 'capture/playback':100C 'channel':48B,188C,197C 'check':108C 'chrdev':322C 'complet':155C 'comput':156C 'corrupt':74B 'count':49B 'crash':82B 'cross':107C 'cross-check':106C 'cve':13A,16A 'declar':43B,180C,253C 'dentri':327C 'deriv':148C 'desc':232C 'descriptor':244C 'detect':103C 'devic':6A,37B,72B,179C 'driver':34B,218C 'emsgsiz':236C 'emul':68B 'end':206C 'endpoint':42B,124C 'entri':367C 'escal':85B 'exploit/5021':282C 'ffff8881098f3c00':279C,382C,406C 'ffff8881098f3ca8':407C 'file':342C 'follow':91C 'format':105C 'frame':157C,231C 'fs/char_dev.c':324C 'fs/namei.c':337C,339C,344C 'fs/open.c':329C,333C,349C,354C,356C,358C 'genuin':248C 'get':131C 'hardwar':252C 'heap':59B 'hwframe':371C 'insid':400C 'interfac':118C 'iso':230C 'kasan':261C 'kernel':2A,9A,21B,29B,75B,89C 'kmalloc':388C 'larg':182C 'lead':79B 'length':234C 'linux':1A,20B,28B,88C 'linux-kernel':19B 'locat':397C 'long':229C 'malform':3A 'mani':195C 'memcpi':202C 'memori':10A,76B 'memset':199C,286C 'mismatch':44B,99C 'mm/kasan/shadow.c':287C 'multipli':173C 'never':120C 'node':55B,216C 'number':141C 'object':380C 'open':12A,51B,212C,296C,301C,307C,315C,319C,323C,328C,332C,343C 'openat':336C,353C 'openat2':348C 'over-long':227C 'overwrit':8A 'packet':45B,101C,137C,162C,255C 'past':57B,204C 'path':335C 'pcm':54B,215C,295C,300C,306C,313C 'playback':41B,53B,117C,129C,169C,171C,192C,196C,209C,270C,291C,294C,314C 'playback.frame':176C 'playback.max':136C 'plug':65B 'privileg':84B 'probe':221C,246C 'proport':254C 'receiv':160C 'region':405C 'regist':219C 'reject':98C,225C,242C 'relat':121C 'resolv':95C 'runtim':22B 'size':46B,102C,256C,275C,391C 'slab':263C 'slab-out-of-bound':262C 'small':191C 'snd':299C,305C,312C,318C 'sound/core/pcm_native.c':303C,308C,310C,316C 'sound/core/sound.c':320C 'sound/usb/misc/ua101.c':271C,292C,297C 'start':167C,268C,289C 'stream':152C 'submit':223C 'substream':302C 'sys':347C,352C 'syscal':361C,368C 'task':281C 'therefor':198C 'time':247C 'trace':284C 'tsamfreq':112C 'two':123C 'ua':135C,249C 'ua101':31B,97C 'unaffect':259C 'urb':130C,154C,224C 'usb':4A,24B,32B,71B,104C,168C,222C,269C,290C 'usb-audio':23B 'vfs':331C 'vulner':92C 'whose':38B 'wmaxpackets':125C,184C,193C 'work':172C 'workstat':26B 'write':56B,241C,273C 'written':144C 'x64':351C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the ua101 USB audio driver enabled, which is mainly used for Edirol/Roland UA-101 and UA-1000 interfaces. The flaw needs a USB device that declares inconsistent packet sizes, so exposure is mostly on machines where untrusted USB devices can be attached. Hosts without this driver or without untrusted USB access can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98741","severity":null,"published_at":"2026-10-18T16:17:27+00:00","modified_at":"2026-10-21T13:21:41+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}