CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: usx2y: bound the hwdep mmap fault offset<br /> <br /> snd_us428ctls_vm_fault() turns the faulting page offset into a kernel<br /> address with no bound of any kind:<br /> <br /> offset = vmf-&gt;pgoff page = page;<br /> <br /> return 0;<br /> <br /> snd_us428ctls_mmap() checks only the length of the mapping, never the<br /> offset, and us428ctls_sharedmem is a single page from<br /> alloc_pages_exact(). For a character device file_mmap_size_max()<br /> returns ULONG_MAX, so the mm layer imposes no ceiling either. Every page<br /> offset above zero resolves to a struct page outside the object, and the<br /> handler installs it into the caller&amp;#39;s address space read-write; the vma<br /> is not marked read-only.<br /> <br /> The caller picks the page frame with a single mmap() argument and gets<br /> read-write access to a page of kernel memory it does not own; an offset<br /> that lands in an unpopulated vmemmap region oopses instead.<br /> <br /> A process that can open the hwdep node of an attached US-X2Y reaches<br /> this after loading the FPGA image through the same node; no capability<br /> check is involved.<br /> <br /> On 7.2.0-rc5 (arm64), mmap() with a large offset:<br /> <br /> Unable to handle kernel paging request at virtual address fffffdffc45d5ac8<br /> pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]<br /> Call trace:<br /> snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]<br /> __do_fault<br /> __handle_mm_fault<br /> handle_mm_fault<br /> el0_da<br /> <br /> Reject any offset outside the shared region. The pcm hwdep handler in<br /> usx2yhwdeppcm.c computes its address the same way and needs the same<br /> bound.<br /> <br /> Discovered by XBOW, triaged by Baul Lee