CVE-2026-74500

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix stack info leak in RME Digiface status

snd_rme_digiface_read_status() reads a four-word status block from the

device into an uninitialised on-stack __le32 buf[4] and, whenever the

vendor control-IN transfer does not return a negative error, copies all

four words into the caller's status[].

snd_usb_ctl_msg() copies the full requested size back into the caller's

buffer regardless of how many bytes the data stage actually delivered:

buf = kmemdup(data, size, GFP_KERNEL);

err = usb_control_msg(dev, pipe, request, requesttype,

value, index, buf, size, timeout);

memcpy(data, buf, size);

usb_control_msg() returns the transferred length on a short control-IN,

which is a non-negative value, and writes only that many bytes. The

remainder of the copy back is the kmemdup()ed image of the caller's

buffer, so a device answering with a short data stage leaves the

trailing words of buf[] holding

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References