960 matches found
SUSE CVE-2026-93808
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
CVE-2026-98006
A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture caiaq USB audio driver. During device initialization failures, the driver prematurely releases memory structures used for USB communication while they remain queued in the host controller. An attacker connecting a craft...
CVE-2026-93808
A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture caiaq USB audio driver. When processing endpoint reply messages, the driver fails to validate the length of received USB data buffers before reading fixed offsets. A physically present attacker connecting a crafted USB...
ROS-20260928-73-0074
The vulnerability of the sndusbcreatestreams function in the Linux operating system’s USB audio driver is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a service failure...
DEBIAN-CVE-2026-93808
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
CVE-2026-93808
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
AZL-103607 CVE-2026-93808 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
UBUNTU-CVE-2026-93808
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
EUVD-2026-86195
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
CVE-2026-93808
The Linux kernel contains a vulnerability in the ALSA: usb-audio: caiaq driver. The function usb_ep1_command_reply_dispatch() fails to verify if the urb->actual_length is sufficient before reading command-specific fixed items from the URB buffer at offsets such as buf[1] , buf[2] , or buf + 3 ...
CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
CVE-2026-93808: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
PT-2026-98008
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA usb-audio caiaq component where the usb ep1 command reply dispatch function fails to verify that the urb-actual length contains the necessary bytes before...
Linux Distros Unpatched Vulnerability : CVE-2026-93808
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the...
CVE-2026-93808
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
PT-2026-104866
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usb ep1 command reply dispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...
ROS-20260918-73-0118
The vulnerability of the parseaudiounit function in the sound/usb/mixer.c module, which supports USB audio devices in Linux operating systems, is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...
SUSE CVE-2026-90033
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput picks a count of 2 on anything slower than high speed and never relates it to ep-maxtransfer. The URB buffer holds exactly maxtransfer bytes, so ...
DEBIAN-CVE-2026-90033
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput picks a count of 2 on anything slower than high speed and never relates it to ep-maxtransfer. The URB buffer holds exactly maxtransfer bytes, so ...