CVE-2026-80829

A flaw was found in the Linux kernel's ALSA USB audio driver. A local attacker with a specially crafted USB device could exploit this vulnerability. By providing a malformed wMaxPacketSize value, the device can trigger an out-of-bounds write in the kernel's memory. This memory corruption could le...

CVE-2026-98837

A flaw was found in the Linux kernel's ALSA caiaq USB audio driver. This flaw allows a local attacker to cause a Denial of Service DoS or potentially escalate privileges. When device initialization fails during the probing process, the driver frees internal device state structures while leaving t...

CVE-2026-98836

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture Line 6 USB audio driver. The driver fails to validate the size of playback packets against the allocated memory buffer slice when handling asymmetrical audio configurations. An attacker capable of connecting a crafted U...

CVE-2026-90033

A flaw was found in the Linux kernel's ALSA USB audio subsystem. The sndusbmidius122loutput function, responsible for handling USB MIDI output, incorrectly calculates the buffer size for devices operating at slower than high speed. This error can lead to an out-of-bounds write, where the system...

CVE-2026-98769

A flaw was found in the Linux kernel's Universal Serial Bus USB audio gadget driver. A connected USB host can send a specially crafted audio control request with an invalid command index, causing an out-of-bounds heap memory read and write. This flaw primarily allows an attacker to cause a Denial...

CVE-2026-98741

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture UA-101 USB audio driver. The driver does not validate that packet sizes and channel numbers match between capture and playback endpoints during device initialization. An attacker who connects a specially crafted USB...

kernel: Fix of 9 CVEs

rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 - xfs: fix freemap adjustments when adding xattrs to leaf blocks CVE-2026-43158 - xfs: delete attr leaf freemap entries when empty CVE-2026-43158 - ALSA: 6fire: fix use-after-free on disconnect CVE-2026-31581 - brcmfmac:...

CVE-2026-80828

A flaw was found in the ALSA Advanced Linux Sound Architecture USB audio driver in the Linux kernel. When a system resume operation fails for a USB audio device, the driver's error handling is incomplete. This can leave the audio card in an unusable state, blocking further control access and...

CVE-2026-93122

A flaw was found in the Linux kernel's USB Audio Class UAC gadget driver. This vulnerability occurs when processing a list of sampling rates, where the driver fails to properly validate the length of the input list. An attacker could provide an overly long list, causing the system to write data...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-38105)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46018)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: stop parsing UAC2 rates at MAXNRRATES parseuac2sampleraterange caps the number of enumerated rates at MAXNRRATES, but it only breaks out of the current rate loop. A malformed UAC2 RANGE response with additional...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46146)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Avoid potential endless loop in convertchmapv3 The convertchmapv3 has a loop with its increment size of csdesc-wLength, but we forgot to validate csdesc-wLength itself, which may lead to potential endless loop by...

Siemens SIMATIC S7-1500 TM MFP Improper Validation of Specified Type of Input (CVE-2026-23318)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UACVERSION2, while it should have been UACVERSION3. This...

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791949745)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791949745 advisory. - In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buff...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput function selects a count of 2 whenever the transfer speed is slower than high-speed. It never checks whether this count corresponds to...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed a possible NULL pointer dereferencing in sndusbpcmhasfixedrate. The argument of the subs function may be NULL; therefore, do not use it before a NULL check...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed potential memory leaks When the driver encounters -ENOMEM while allocating a URB or a buffer, it abends and proceeds to the error handling path, releasing all previously allocated resources. However, when...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Properly terminating the timer upon removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call being made. This leaves the timer in an active...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Remove sndBUGON from sndusbmidioutputopen The function sndusbmidioutputopen includes a check for the NULL port, which involves calling sndBUGON. The use of sndBUGON was intended to prevent such issues from...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans The sndusbmidigetmsinfo function validates the size of the internal MIDIStreaming endpoint descriptor before using the baAssocJackID array. However, the descriptor walker may...