CVE-2026-98836

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: line6: reject oversized playback packets

Each playback URB is handed a slice of out.buffer that is exactly

LINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT

endpoint, but the number of bytes written into that slice is never

compared against it.

submit_audio_out_urb() takes the frame count from prev_fsize, which

audio_in_callback() derived from the *IN* endpoint's received packet

length, and rescales it with the playback frame size; when prev_fsize is

still zero it synthesizes a length from the sample rate instead. On a

device declaring a large IN wMaxPacketSize and a small OUT

wMaxPacketSize, the resulting memcpy(), or the memset() when the

playback stream is idle, runs past its slice and, as the reproducer

below shows, beyond the allocation.

usb_submit_urb() is not a backstop. max_packet_size_out comes from

usb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize,

while USB cor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References