CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

CVE-2026-93808

The Linux kernel contains a vulnerability in the ALSA: usb-audio: caiaq driver. The function usb_ep1_command_reply_dispatch() fails to verify if the urb->actual_length is sufficient before reading command-specific fixed items from the URB buffer at offsets such as buf[1] , buf[2] , or buf + 3 ...