CVE-2026-23208

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Prevent excessive number of frames

In this case, the user constructed the parameters with maxpacksize 40

for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer

size for each data URB is maxpacksize * packets, which in this example

is 40 * 6 = 240; When the user performs a write operation to send audio

data into the ALSA PCM playback stream, the calculated number of frames

is packsize[0] * packets = 264, which exceeds the allocated URB buffer

size, triggering the out-of-bounds (OOB) issue reported by syzbot [1].

Added a check for the number of single data URB frames when calculating

the number of frames to prevent [1].

[1]

BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487

Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506

Call Trace:

copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487

prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611

prep

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References