---
id: "CVE-2026-98769"
kind: "vulnerability"
aliases: ["CVE-2026-98769"]
title: "Linux kernel USB audio gadget: out-of-bounds write from crafted USB requests"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "linux-kernel", "fixed": ["6.12.113", "6.18.56", "7.2.10"], "affected": ">= 2.6.31, < 6.12.113 / < 6.18.56 / < 7.2.10 (6.6.x: fixed in 6.6.160 per OSV only)", "ecosystem": "linux"}]
ecosystems: []
tags: ["embedded", "f_uac1_legacy", "infrastructure", "linux-kernel", "usb-gadget"]
not_affected_if: ["f_uac1_legacy-not-enabled", "no-usb-gadget-driver", "usb-host-only"]
published_at: "2026-10-18T16:17:30+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:16:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98769", "first_seen_at": "2026-10-23T21:57:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T05:16:44+00:00"}]
---

# Linux kernel USB audio gadget: out-of-bounds write from crafted USB requests

The Linux kernel's legacy USB audio gadget driver indexes a five-element array with an unchecked value taken from a USB control request. A malicious USB host can write or read up to 44 bytes past the end of a heap array from an interrupt handler.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- linux:linux-kernel affected >= 2.6.31, < 6.12.113 / < 6.18.56 / < 7.2.10 (6.6.x: fixed in 6.6.160 per OSV only) fixed 6.12.113, 6.18.56, 7.2.10

## How to check

Run uname -r and compare with the fixed versions. Then check whether the driver is present: zcat /proc/config.gz | grep -E 'UAC1_LEGACY|USB_G_AUDIO' (or grep /boot/config-$(uname -r)), lsmod | grep -E 'f_uac1_legacy|g_audio|usb_f_uac1_legacy', and on configfs gadgets look for a function named uac1_legacy under /sys/kernel/config/usb_gadget/. If the driver is not built or used, you are not exposed.

## Fix

Update to a kernel containing commit 9062d50e75c2 (mainline; 7.3-rc6 unaffected): 6.12.113, 6.18.56, 7.2.10 or later in those series. 6.6.160 is listed by OSV only. Debian: trixie 6.12.113-1, bookworm linux-6.12 6.12.113-1~deb12u1 fixed; bookworm 6.1.x still vulnerable at last check. Other series: unknown, check your vendor kernel changelog.

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98769
- 2026-10-25T05:16:44+00:00 analyst — Read kernel CNA record (cve.org), fix commit 9062d50e75 and OSV/Debian tracker. Introduced by c47d7b09891a (2.6.31); fixed 6.12.113, 6.18.56, 7.2.10 per cve.org; OSV also lists 6.6.160 but cve.org does not, so unconfirmed. Not exploited, no public PoC found. Did not verify distro enablement of f_uac1_legacy; no fields marked verified (tier B, kernel.org pages not read directly).

## Documents

- [advisory] CVE record (kernel CNA) https://www.cve.org/CVERecord?id=CVE-2026-98769
- [fix] Kernel fix commit: f_uac1_legacy validate bRequest index https://git.kernel.org/stable/c/9062d50e75c24dc7911be05c9b1719b3b256af15
- [mentions] Debian security tracker https://security-tracker.debian.org/tracker/CVE-2026-98769

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd

generic_set_cmd() and generic_get_cmd() use the low nibble of
ctrl->bRequest as an index into con->data[]:

    u8 cmd = (ctrl->bRequest & 0x0F);  /* 0 .. 15 */
    ...
    con->data[cmd] = value;            /* OOB when cmd >= 5 */

struct usb_audio_control (include/linux/usb/audio.h) declares data as
a 5-element array, so indices 5 through 15 write (or read) up to 44
bytes past the end of the array on the heap.

A malicious USB host can craft a class-specific SET_CUR / GET_CUR
request with an arbitrary bRequest value, triggering the out-of-bounds
access from an IRQ completion handler with no further preconditions.

Add an ARRAY_SIZE() guard to both functions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_