libmsm_acdb_exploit

Original code is written by @gorohkun https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597...

CVE-2019-9730

CVE-2019-9730: Synaptics Audio Driver LPE The vulnerability in this driver package was with the CxUtilSvc system service. It hosted a COM object that low-privileged code can use to perform arbitrary reads and writes to the registry as SYSTEM. The .NET code adds the IRegistryHelper COM interface a...

CVE-2026-99271

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA Line 6 USB audio driver. When releasing audio capture buffers, the driver fails to clear an internal buffer pointer, leaving a stale reference to freed memory. A local user can exploit this issue by triggering audio...

CVE-2026-90975

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control IOCTL interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mo...

CVE-2026-122113

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and...

EUVD-2026-118417

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and...

CVE-2026-122113

A vulnerability exists in Realtek's RtUsbA64.sys USB audio driver, where a physically present attacker can use a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor leads to kernel stack ...

CVE-2026-122113 CVE-2026-122113

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and...

CVE-2026-90975

A vulnerability exists in Realtek's RtUsbA64.sys USB audio driver, where a local, low-privileged user can abuse a kernel I/O control (IOCTL) interface . The root cause is the lack of proper validation or capture of a caller-supplied user-mode pointer. By issuing crafted property requests, an atta...

EUVD-2026-118416

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control IOCTL interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mo...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g., firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hdacomponentmanagerinit function The componentmatchadd function may assign the ‘matchptr’ pointer the value ERRPTR-ENOMEM, which will subsequently be dereferenced. The call stack leading to...

CVE-2026-98940

A flaw was found in the Linux kernel's Qualcomm audio driver LPASS CPU. When configuring digital audio interfaces on certain platforms, the driver uses a hardware port identifier instead of the table index to update playback constraints. This issue causes an out-of-bounds memory write, which can...

CVE-2026-99089

A flaw was found in the Linux kernel's Samsung I2S audio driver. The driver's initialization routine configures runtime power management without enabling the associated operating clock, leaving clock reference counters out of balance. When the device transitions into a suspended state, the kernel...

CVE-2026-80829

A flaw was found in the Linux kernel's ALSA USB audio driver. A local attacker with a specially crafted USB device could exploit this vulnerability. By providing a malformed wMaxPacketSize value, the device can trigger an out-of-bounds write in the kernel's memory. This memory corruption could le...

CVE-2026-98837

A flaw was found in the Linux kernel's ALSA caiaq USB audio driver. This flaw allows a local attacker to cause a Denial of Service DoS or potentially escalate privileges. When device initialization fails during the probing process, the driver frees internal device state structures while leaving t...

CVE-2026-98836

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture Line 6 USB audio driver. The driver fails to validate the size of playback packets against the allocated memory buffer slice when handling asymmetrical audio configurations. An attacker capable of connecting a crafted U...

CVE-2026-98741

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture UA-101 USB audio driver. The driver does not validate that packet sizes and channel numbers match between capture and playback endpoints during device initialization. An attacker who connects a specially crafted USB...

CVE-2026-80828

A flaw was found in the ALSA Advanced Linux Sound Architecture USB audio driver in the Linux kernel. When a system resume operation fails for a USB audio device, the driver's error handling is incomplete. This can leave the audio card in an unusable state, blocking further control access and...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Properly kill the timer upon removal The USB-audio MIDI code initializes the timer; however, in a rare case, the driver may be freed without calling the disconnect function. This leaves the timer in an active sta...