CVE-2026-74682

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: usb-audio: fix OOB write on Type II inbound URBs<br /> <br /> data_ep_set_params() sizes each URB transfer buffer before it adds the<br /> Format Type II transfer delimiter:<br /> <br /> u-&gt;packets = urb_packs;<br /> u-&gt;buffer_size = maxsize * u-&gt;packets;<br /> <br /> if (fmt-&gt;fmt_type == UAC_FORMAT_TYPE_II)<br /> u-&gt;packets++; /* for transfer delimiter */<br /> u-&gt;urb = usb_alloc_urb(u-&gt;packets, GFP_KERNEL);<br /> <br /> buffer_size is computed from the pre-increment packet count and never<br /> recomputed, so for a Type II endpoint the buffer is one packet short of<br /> the packet count the URB is built with.<br /> <br /> prepare_inbound_urb() then lays out one iso frame per packet and never<br /> consults buffer_size:<br /> <br /> offs = 0;<br /> for (i = 0; i packets; i++) {<br /> urb-&gt;iso_frame_desc[i].offset = offs;<br /> urb-&gt;iso_frame_desc[i].length = ep-&gt;curpacksize;<br /> offs += ep-&gt;curpacksize;<br /> }<br /> <br /> urb-&gt;transfer_buffer_length = offs;<br /> urb-&gt;number_of_packets = urb_ctx-&gt;packets;<br /> <br /> The last descriptor therefore points one packet past the end of the<br /> transfer buffer, where the host controller writes device data on every<br /> inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound<br /> their fill loops by ctx-&gt;buffer_size, so only capture is affected.<br /> <br /> fmt_type comes from the device&amp;#39;s audio streaming descriptors, so any<br /> device advertising a Type II capture format hits this once userspace sets<br /> hw_params on the stream.<br /> <br /> KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report<br /> per inbound transfer:<br /> <br /> BUG: KASAN: slab-out-of-bounds in dummy_timer<br /> Write of size 64 at addr ffff0000186171c0 by task cons02/166<br /> __asan_memcpy<br /> dummy_timer<br /> hrtimer_run_softirq<br /> Allocated by task 166:<br /> usb_alloc_coherent<br /> snd_usb_endpoint_set_params<br /> The buggy address is located 0 bytes to the right of<br /> allocated 64-byte region [ffff000018617180, ffff0000186171c0)<br /> <br /> Compute buffer_size after the delimiter packet has been accounted for,<br /> and bound the fill loop by buffer_size, as prepare_silent_urb() already<br /> does on the outbound side. This grows every Type II URB allocation by<br /> one maxsize packet.<br /> <br /> Discovered by XBOW, triaged by Baul Lee