CVE-2026-97929

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usbusx2y: validate URB actual_length in interrupt callback

i_usx2y_in04_int() processes the interrupt URB data without checking

urb->actual_length. A short transfer from a malfunctioning device

would cause the handler to process uninitialized heap data from the

kmalloc-allocated in04_buf, which is then copied to the mmap-accessible

ctl_snapshot[] array.

Fix by using kzalloc() for in04_buf to zero-initialize the buffer,

and adding an actual_length check to skip processing on short

transfers while still resubmitting the URB.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References