{"id":"CVE-2026-98836","kind":"vulnerability","aliases":["CVE-2026-98836"],"related":[],"title":"Linux kernel line6 driver: oversized USB playback packets overflow memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: reject oversized playback packets\n\nEach playback URB is handed a slice of out.buffer that is exactly\nLINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT\nendpoint, but the number of bytes written into that slice is never\ncompared against it.\n\nsubmit_audio_out_urb() takes the frame count from prev_fsize, which\naudio_in_callback() derived from the *IN* endpoint's received packet\nlength, and rescales it with the playback frame size; when prev_fsize is\nstill zero it synthesizes a length from the sample rate instead.  On a\ndevice declaring a large IN wMaxPacketSize and a small OUT\nwMaxPacketSize, the resulting memcpy(), or the memset() when the\nplayback stream is idle, runs past its slice and, as the reproducer\nbelow shows, beyond the allocation.\n\nusb_submit_urb() is not a backstop.  max_packet_size_out comes from\nusb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize,\nwhile USB core validates a high-speed isochronous length against that\nbase scaled by usb_endpoint_maxp_mult().  A length of up to three times\nthe allocated slice is therefore accepted, and even a rejected URB is\nonly rejected after the write.\n\nReject a packet that does not fit the slice the driver allocated for it.\nClamping it instead would silently shorten the capture-derived rate\nfeedback and desynchronize the two streams.\n\n  BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound/usb/line6/playback.c:229)\n  Write of size 1024 at addr ffff888100bbd400 by task kworker/1:2/5002\n  Workqueue: events line6_startup_work\n  Call Trace:\n   __asan_memcpy (mm/kasan/shadow.c:106)\n   submit_audio_out_urb (sound/usb/line6/playback.c:229)\n   line6_submit_audio_out_all_urbs (sound/usb/line6/playback.c:291)\n   line6_stream_start (sound/usb/line6/pcm.c:194)\n   line6_pcm_acquire (sound/usb/line6/pcm.c:337)\n   line6_startup_work (sound/usb/line6/driver.c:728)\n   process_one_work (kernel/workqueue.c:3396)\n   worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n  The buggy address belongs to the object at ffff888100bbd400\n   which belongs to the cache kmalloc-256 of size 256\n  The buggy address is located 0 bytes inside of\n   allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)","summary":"The Linux ALSA line6 USB audio driver copies playback data into a buffer without checking its size, so a crafted USB device with a large IN endpoint packet size can write past the allocated memory. KASAN reports a slab out-of-bounds write from a kernel workqueue, which can corrupt kernel memory.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alsa","infrastructure","line6","linux-kernel","usb-audio"],"not_affected_if":["driver-not-loaded","no-line6-hardware","physical-access-controlled"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the kernel stable advisory for CVE-2026-98836\n- `lsmod | grep line6` to see whether the line6 driver is loaded\n- Check whether a Line 6 USB audio device is attached with `lsusb | grep -i line6`","fix":"- Update the Linux kernel to a stable release that includes the upstream commit 'ALSA: line6: reject oversized playback packets'\n- Until patched, unload the driver with `modprobe -r snd-usb-line6` if no Line 6 device is needed","status":"open","published_at":"2026-10-18T16:17:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:18+00:00","updated_at":"2026-10-25T05:13:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:13:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the upstream commit 'ALSA: line6: reject oversized playback packets'\n- Until patched, unload the driver with `modprobe -r snd-usb-line6` if no Line 6 device is needed","reach":"local","title":"Linux kernel line6 driver: oversized USB playback packets overflow memory","impact":"high","summary":"The Linux ALSA line6 USB audio driver copies playback data into a buffer without checking its size, so a crafted USB device with a large IN endpoint packet size can write past the allocated memory. KASAN reports a slab out-of-bounds write from a kernel workqueue, which can corrupt kernel memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","usb-audio","alsa","line6"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel memory corruption from a malicious USB device, possibly code execution","analyst_note":"Sources give no fixed kernel version or stable commit id; check the kernel.org CVE record and stable tree for the fixed versions.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the kernel stable advisory for CVE-2026-98836\n- `lsmod | grep line6` to see whether the line6 driver is loaded\n- Check whether a Line 6 USB audio device is attached with `lsusb | grep -i line6`","needs_analyst":true,"not_affected_if":["no-line6-hardware","driver-not-loaded","physical-access-controlled"],"who_is_affected":"Only systems that load the line6 ALSA USB driver are exposed, which means machines with a Line 6 USB audio interface or a device that presents itself as one. The bug needs a USB device whose IN endpoint declares a large wMaxPacketSize and a small OUT endpoint, so ordinary hosts without line6 hardware or the module can skip it. Exploitation requires physical attachment of a malicious USB device.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000787,"input_tokens":4238,"output_tokens":727,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-256':422C '-98836':13A,16A '0':431C '1024':334C '106':352C '11':239C '158':400C '194':371C '2/5002':341C '229':330C,358C '245':406C '256':425C,436C '291':366C '337':376C '3396':386C '3479':390C '3560':392C '436':395C '728':381C 'accept':274C 'acquir':374C 'addr':336C 'address':409C,428C 'alloc':59B,218C,270C,297C,435C 'alsa':17B,28B,89C 'arch/x86/entry/entry_64.s':405C 'arch/x86/kernel/process.c':399C 'asan':349C 'asm':404C 'audio':25B,31B,135C,146C,326C,354C,361C 'backstop':225C 'base':255C 'belong':410C,417C 'beyond':216C 'bit':240C 'bound':68B,323C 'buffer':38B 'bug':317C 'buggi':408C,427C 'byte':114C,124C,432C,437C 'cach':420C 'call':347C 'callback':148C 'captur':308C 'capture-deriv':307C 'check':40B 'clamp':300C 'come':230C 'compar':131C 'copi':33B 'core':245C 'corrupt':76B 'count':141C 'craft':45B 'cve':11A,14A 'data':35B 'declar':184C 'deriv':149C,309C 'desynchron':313C 'devic':47B,183C 'driver':4A,32B,296C 'endpoint':52B,119C,153C,259C 'even':276C 'event':343C 'exact':106C 'feedback':311C 'ffff888100bbd400':337C,415C,439C 'ffff888100bbd500':440C 'fit':292C 'follow':84C 'fork':398C,403C 'frame':140C,164C 'fsize':144C,168C 'hand':99C 'high':249C 'high-spe':248C 'idl':205C 'infrastructur':18B 'insid':433C 'instead':180C,302C 'iso':108C 'isochron':251C 'kasan':61B,318C 'kernel':2A,22B,72B,77B,82C 'kernel/kthread.c':394C 'kernel/workqueue.c':385C,389C,391C 'kmalloc':421C 'kthread':393C 'kworker/1':340C 'larg':50B,186C 'length':157C,175C,252C,263C 'line6':3A,19B,29B,90C,107C,344C,359C,367C,372C,377C 'linux':1A,21B,27B,81C 'linux-kernel':20B 'locat':430C 'low':238C 'max':110C,226C 'maxp':260C 'maxpacket':233C 'memcpi':196C,350C 'memori':10A,60B,78B 'memset':199C 'mm/kasan/shadow.c':351C 'mult':261C 'never':130C 'number':122C 'object':413C 'one':383C 'out-of-bound':65B 'out.buffer':103C 'overflow':9A 'overs':5A,92C 'packet':8A,53B,94C,109C,111C,156C,227C,288C 'past':57B,207C 'pcm':373C 'playback':7A,34B,93C,96C,163C,202C 'prev':143C,167C 'process':382C 'rate':179C,310C 'receiv':155C 'region':438C 'reject':91C,278C,282C,286C 'report':62B 'reproduc':213C 'rescal':159C 'resolv':88C 'result':195C 'ret':396C,401C 'return':235C 'run':206C 'sampl':178C 'scale':256C 'shorten':305C 'show':215C 'silent':304C 'size':42B,54B,112C,115C,165C,228C,333C,424C 'slab':64B,320C 'slab-out-of-bound':319C 'slice':101C,128C,209C,271C,294C 'small':191C 'sound/usb/line6/driver.c':380C 'sound/usb/line6/pcm.c':370C,375C 'sound/usb/line6/playback.c':329C,357C,365C 'speed':250C 'start':369C 'startup':345C,378C 'still':170C 'stream':203C,316C,368C 'submit':134C,220C,325C,353C,360C 'synthes':173C 'take':138C 'task':339C 'therefor':273C 'thread':388C 'three':267C 'time':268C 'trace':348C 'two':315C 'urb':97C,137C,221C,279C,328C,356C,364C 'usb':6A,24B,30B,46B,219C,232C,244C,258C 'usb-audio':23B 'valid':246C 'vulner':85C 'without':39B 'wmaxpackets':188C,193C,242C 'work':346C,379C,384C 'worker':387C 'workqueu':73B,342C 'would':303C 'write':56B,69B,285C,331C 'written':125C 'zero':171C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load the line6 ALSA USB driver are exposed, which means machines with a Line 6 USB audio interface or a device that presents itself as one. The bug needs a USB device whose IN endpoint declares a large wMaxPacketSize and a small OUT endpoint, so ordinary hosts without line6 hardware or the module can skip it. Exploitation requires physical attachment of a malicious USB device.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98836","severity":null,"published_at":"2026-10-18T16:17:37+00:00","modified_at":"2026-10-21T13:21:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}