CVE-2026-80815

CVE-2026-80815 affects the ALSA scarlett2 driver in the Linux kernel, used for Focusrite Scarlett 2nd-generation USB audio interfaces. The root cause is that scarlett2_init_notify() shared mixer->urb with the UAC2 status interrupt endpoint managed by mixer.c. On devices with that endpoint, the...

CVE-2026-80815 ALSA: scarlett2: Use a private URB for the notification endpoint

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that...

Linux Distros Unpatched Vulnerability : CVE-2026-80827

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's...

Linux Distros Unpatched Vulnerability : CVE-2026-80824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed asy...

Linux Distros Unpatched Vulnerability : CVE-2026-80826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb gives the URB back before...

SUSE CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

UBUNTU-CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-74680

A flaw was found in the Linux kernel's cxacru USB ATM driver. When the cxacrucm function encounters an error, it fails to properly terminate an already submitted receive USB Request Block URB. This oversight can lead to the driver attempting to resubmit an active URB, which triggers a warning in...

CVE-2026-74639

A flaw was found in the Linux kernel, specifically within the ALSA us144mkii driver. The captureurbcomplete function resubmits capture Urban Request Blocks URBs without properly re-anchoring them. This oversight allows URBs to remain queued on the host controller even after their associated memor...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: media: zr364xx: fixed a memory leak in zr364xxstartreadpipe syzbot reported a memory leak in the zr364xx driver. The issue occurred when non-free urb occurred in case of a failure in usbsubmiturb. Backtrace: kmalloc...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usbnet: Fixed an issue in usbnetstartxmit/usbsubmiturb. The syzbot fuzzer identified a problem with the usbnet driver: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504;...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed potential memory leaks When the driver encounters -ENOMEM while allocating a URB or a buffer, it abends and proceeds to the error handling path, releasing all previously allocated resources. However, when...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fixed a possible NULL pointer dereferencing caused by driver concurrency. In dwc2hcdurbenqueue, the statement “urb-hcpriv = NULL” is executed without holding the lock “hsotg-lock”. In dwc2hcdurbdequeue: c...

SUSE CVE-2026-74682

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

AZL-97257 CVE-2026-74682 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

CVE-2026-74680

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcvurb on error in cxacrucm If cxacrucm encounters an error while submitting or waiting for sndurb, it aborts and returns the error without killing the already submitted rcvurb. This leaves the...

CVE-2026-74682

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

CVE-2026-74639

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74682

CVE-2026-74682 is an out-of-bounds write in the Linux kernel ALSA usb-audio subsystem affecting Type II capture (inbound) URBs . In data_ep_set_params(), the URB transfer buffer size is computed before the Type II transfer delimiter packet is added to the packet count, leaving the buffer one pack...