CVE-2026-74682

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio driver. This vulnerability involves an out-of-bounds write, where the system attempts to write data beyond the allocated memory buffer. This occurs due to incorrect buffer sizing when processing data from...

CVE-2026-74641

A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...

CVE-2026-74639

A flaw was found in the Linux kernel, specifically within the ALSA us144mkii driver. The captureurbcomplete function resubmits capture Urban Request Blocks URBs without properly re-anchoring them. This oversight allows URBs to remain queued on the host controller even after their associated memor...

CVE-2026-74640

A flaw was found in the Linux kernel's ALSA FireWire Control Protocol FCP. An unprivileged process can trigger an out-of-bounds write by reading controls on /dev/snd/controlC0 after an oversized Level Meter map has been installed. This occurs because the fcpmeterctlget function writes beyond its...

CVE-2026-74642

A flaw was found in the ALSA USB MIDI2 EPs component of the Linux kernel. This use-after-free UAF vulnerability occurs due to a delayed release of MIDI2 endpoints, leading to an attempt to dereference an already freed Universal MIDI Packet UMP endpoint object. An attacker could potentially exploi...

FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow,...

FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow,...

SUSE CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74682

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

CVE-2026-74639

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74640

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

EUVD-2026-64369

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

CVE-2026-74682

CVE-2026-74682 is an out-of-bounds write in the Linux kernel ALSA usb-audio subsystem affecting Type II capture (inbound) URBs . In data_ep_set_params(), the URB transfer buffer size is computed before the Type II transfer delimiter packet is added to the packet count, leaving the buffer one pack...

CVE-2026-74682 ALSA: usb-audio: fix OOB write on Type II inbound URBs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

CVE-2026-74682 ALSA: usb-audio: fix OOB write on Type II inbound URBs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

EUVD-2026-64579

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74642

CVE-2026-74642 is a Use-After-Free (UAF) vulnerability in the Linux kernel's ALSA USB subsystem , specifically in the handling of MIDI 2.0 (UMP) endpoints . A prior fix for a UAF in ump_to_endpoint() inadvertently introduced a second UAF: the code dereferences the UMP endpoint object in a delayed...

CVE-2026-74642 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...