Live › vulnerability › CVE-2026-98769
Go to dashboardThe Linux kernel's legacy USB audio gadget driver indexes a five-element array with an unchecked value taken from a USB control request. A malicious USB host can write or read up to 44 bytes past the end of a heap array from an interrupt handler.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel that uses the f_uac1_legacy USB audio gadget function, typically devices acting as USB peripherals such as embedded boards or USB gadget setups. Hosts that only use Linux as a USB host, and machines without the gadget driver loaded, are not exposed. The sources do not say which kernel versions contain the flaw or which fixed release to use.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| linux-kernel | linux | >= 2.6.31, < 6.12.113 / < 6.18.56 / < 7.2.10 (6.6.x: fixed in 6.6.160 per OSV only) | 6.12.113, 6.18.56, 7.2.10 |
UAC1_LEGACY|USB_G_AUDIO (or grep /boot/config-$(uname -r)), lsmod | grep -E f_uac1_legacy|g_audio|usb_f_uac1_legacy, and on configfs gadgets look for a function named uac1_legacy under /sys/kernel/config/usb_gadget/6.12.113, 6.18.56, 7.2.10 or later in those series. 6.6.160 is listed by OSV only6.12.113-1, bookworm linux-6.12 6.12.113-1~deb12u1 fixed; bookworm 6.1.x still vulnerable at last checkEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index into con->data[]:
u8 cmd = (ctrl->bRequest & 0x0F); /* 0 .. 15 */
...
con->data[cmd] = value; /* OOB when cmd >= 5 */
struct usb_audio_control (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap.
A malicious USB host can craft a class-specific SET_CUR / GET_CUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions.
Add an ARRAY_SIZE() guard to both functions.
This page as .md · .json · in your agent: get_signal("CVE-2026-98769")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.