{"id":"CVE-2026-98769","kind":"vulnerability","aliases":["CVE-2026-98769"],"related":[],"title":"Linux kernel USB audio gadget: out-of-bounds write from crafted USB requests","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd\n\ngeneric_set_cmd() and generic_get_cmd() use the low nibble of\nctrl->bRequest as an index into con->data[]:\n\n    u8 cmd = (ctrl->bRequest & 0x0F);  /* 0 .. 15 */\n    ...\n    con->data[cmd] = value;            /* OOB when cmd >= 5 */\n\nstruct usb_audio_control (include/linux/usb/audio.h) declares data as\na 5-element array, so indices 5 through 15 write (or read) up to 44\nbytes past the end of the array on the heap.\n\nA malicious USB host can craft a class-specific SET_CUR / GET_CUR\nrequest with an arbitrary bRequest value, triggering the out-of-bounds\naccess from an IRQ completion handler with no further preconditions.\n\nAdd an ARRAY_SIZE() guard to both functions.","summary":"The Linux kernel's legacy USB audio gadget driver indexes a five-element array with an unchecked value taken from a USB control request. A malicious USB host can write or read up to 44 bytes past the end of a heap array from an interrupt handler.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"linux-kernel","fixed":["6.12.113","6.18.56","7.2.10"],"affected":">= 2.6.31, < 6.12.113 / < 6.18.56 / < 7.2.10 (6.6.x: fixed in 6.6.160 per OSV only)","ecosystem":"linux"}],"ecosystems":[],"tags":["embedded","f_uac1_legacy","infrastructure","linux-kernel","usb-gadget"],"not_affected_if":["f_uac1_legacy-not-enabled","no-usb-gadget-driver","usb-host-only"],"how_to_check":"Run uname -r and compare with the fixed versions. Then check whether the driver is present: zcat /proc/config.gz | grep -E 'UAC1_LEGACY|USB_G_AUDIO' (or grep /boot/config-$(uname -r)), lsmod | grep -E 'f_uac1_legacy|g_audio|usb_f_uac1_legacy', and on configfs gadgets look for a function named uac1_legacy under /sys/kernel/config/usb_gadget/. If the driver is not built or used, you are not exposed.","fix":"Update to a kernel containing commit 9062d50e75c2 (mainline; 7.3-rc6 unaffected): 6.12.113, 6.18.56, 7.2.10 or later in those series. 6.6.160 is listed by OSV only. Debian: trixie 6.12.113-1, bookworm linux-6.12 6.12.113-1~deb12u1 fixed; bookworm 6.1.x still vulnerable at last check. Other series: unknown, check your vendor kernel changelog.","status":"open","published_at":"2026-10-18T16:17:30+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:32+00:00","updated_at":"2026-10-25T05:16:44+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T05:15:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel USB audio gadget: out-of-bounds write from crafted USB requests","impact":"high","summary":"The Linux kernel's legacy USB audio gadget driver indexes a five-element array with an unchecked value taken from a USB control request. A malicious USB host can write or read up to 44 bytes past the end of a heap array from an interrupt handler.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","usb-gadget","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel heap memory corrupted or read from a USB device","analyst_note":"Check the upstream kernel commit and stable backports for affected and fixed versions, and whether f_uac1_legacy is enabled in common distro kernels.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-usb-gadget-driver","usb-host-only"],"who_is_affected":"Systems running a Linux kernel that uses the f_uac1_legacy USB audio gadget function, typically devices acting as USB peripherals such as embedded boards or USB gadget setups. Hosts that only use Linux as a USB host, and machines without the gadget driver loaded, are not exposed. The sources do not say which kernel versions contain the flaw or which fixed release to use.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000609,"input_tokens":3563,"output_tokens":505,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the upstream kernel commit and stable backports for affected and fixed versions, and whether f_uac1_legacy is enabled in common distro kernels.","search":"'-2026':16A,19A '-98769':17A,20A '0':131C '0x0f':130C '15':132C,157C '44':70B,163C '5':140C,150C,155C 'access':200C 'add':210C 'arbitrari':191C 'array':49B,78B,152C,170C,212C 'audio':4A,41B,143C 'bound':9A,199C 'brequest':99C,119C,129C,192C 'byte':71B,164C 'class':182C 'class-specif':181C 'cmd':105C,108C,112C,127C,135C,139C 'complet':204C 'con':124C,133C 'control':58B,144C 'craft':12A,179C 'ctrl':118C,128C 'cur':185C,187C 'cve':15A,18A 'data':125C,134C,147C 'declar':146C 'driver':43B 'element':48B,151C 'embed':24B 'end':74B,167C 'f':25B,95C 'five':47B 'five-el':46B 'follow':88C 'function':217C 'gadget':5A,34B,42B,94C 'generic':102C,106C,110C 'get':104C,111C,186C 'guard':214C 'handler':82B,205C 'heap':77B,173C 'host':63B,177C 'include/linux/usb/audio.h':145C 'index':44B,100C,122C 'indic':154C 'infrastructur':28B 'interrupt':81B 'irq':203C 'kernel':2A,23A,31B,37B,86C 'legaci':27B,39B,97C 'linux':1A,22A,30B,36B,85C 'linux-kernel':21A,29B 'low':115C 'malici':61B,175C 'nibbl':116C 'oob':137C 'out-of-bound':6A,196C 'past':72B,165C 'precondit':209C 'read':67B,160C 'request':14A,59B,188C 'resolv':92C 'set':103C,107C,184C 'size':213C 'specif':183C 'struct':141C 'taken':54B 'trigger':194C 'u8':126C 'uac1':26B,96C 'uncheck':52B 'usb':3A,13A,33B,40B,57B,62B,93C,142C,176C 'usb-gadget':32B 'use':113C 'valid':98C 'valu':53B,136C,193C 'vulner':89C 'write':10A,65B,158C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel that uses the f_uac1_legacy USB audio gadget function, typically devices acting as USB peripherals such as embedded boards or USB gadget setups. Hosts that only use Linux as a USB host, and machines without the gadget driver loaded, are not exposed. The sources do not say which kernel versions contain the flaw or which fixed release to use.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98769","severity":null,"published_at":"2026-10-18T16:17:30+00:00","modified_at":"2026-10-21T13:21:45+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-98769:819","url":null,"severity":null,"published_at":"2026-10-25T05:16:44+00:00","modified_at":"2026-10-25T05:16:44+00:00","first_seen_at":"2026-10-25T05:16:44+00:00","fetched_at":"2026-10-25T05:16:44+00:00","note":"Read kernel CNA record (cve.org), fix commit 9062d50e75 and OSV/Debian tracker. Introduced by c47d7b09891a (2.6.31); fixed 6.12.113, 6.18.56, 7.2.10 per cve.org; OSV also lists 6.6.160 but cve.org does not, so unconfirmed. Not exploited, no public PoC found. Did not verify distro enablement of f_uac1_legacy; no fields marked verified (tier B, kernel.org pages not read directly)."}],"documents":[{"id":3415,"url":"https://git.kernel.org/stable/c/9062d50e75c24dc7911be05c9b1719b3b256af15","title":"Kernel fix commit: f_uac1_legacy validate bRequest index","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3416,"url":"https://www.cve.org/CVERecord?id=CVE-2026-98769","title":"CVE record (kernel CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3417,"url":"https://security-tracker.debian.org/tracker/CVE-2026-98769","title":"Debian security tracker","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}