Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize. The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits. Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-15T13:17:54.657Z",
  "pubdate": "2026-08-15T13:17:54.657Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel ALSA subsystem within the USB audio driver, specifically affecting the handling of implicit-feedback mode. The vulnerability arises from an integer or bounds validation flaw where received synchronization packet sizes are scaled and stored without adequate boundary checks. An attacker capable of connecting a malicious USB device or exploiting an existing device connection can transmit oversized sync packets, leading to a frame count that exceeds the allocated endpoint hardware limits (ep->maxframesize).\nThe primary impact of this flaw is the propagation of un-clamped frame counts into the playback endpoint queue, which drives packet transfers beyond hardware boundaries and can lead to memory corruption, kernel instability, or denial of service. The affected system is the Linux kernel ALSA USB audio driver handling USB devices operating in implicit-feedback mode. Exploitation requires physical access to connect a specially crafted USB device or the ability to emulate a USB device capable of interacting with the host controller. Risk implications include potential local denial of service and system crashes resulting from out-of-bounds memory operations or buffer overflows within the kernel memory space.",
  "technicalDetails": "The vulnerability resides within the snd_usb_handle_sync_urb() function in the Linux kernel ALSA usb-audio driver. During the processing of synchronization URBs (USB Request Blocks) in implicit-feedback mode, the function scales received sync packet sizes by the sender's stride. Historically, the calculated result was stored directly into out_packet->packet_size[i] without validating whether the resulting frame count exceeded the maximum frame size defined for the endpoint (ep->maxframesize).\nThe step-by-step attack flow begins when a connected USB audio device sends a malformed or oversized synchronization packet to the host. The snd_usb_handle_sync_urb() function processes this packet and calculates an inflated frame count based on the malicious packet size and the sender stride. Because no upper-bound check is enforced at this stage, the excessive frame count bypasses validation and is written directly to the packet size array. Subsequently, this un-clamped frame count propagates into the playback endpoint queue. When the audio subsystem processes the playback queue, it relies on these stored frame sizes to execute packet transfers, resulting in operations that exceed the endpoint's hardware frame limits (ep->maxframesize). This mismatch between expected buffer boundaries and actual transfer sizes can trigger buffer overflows, overwrite adjacent kernel memory structures, or cause kernel panics and denial of service.\nThe vulnerable component is the ALSA USB audio driver, specifically the synchronization handling logic in sound/usb/endpoint.c or related files governed by snd_usb_handle_sync_urb(). The flaw affects systems utilizing Linux kernel versions prior to the integration of the fix. Authentication and privilege requirements depend on the physical or logical ability to attach a USB device to the target host; standard unprivileged remote network access is typically not applicable unless USB/IP (USB over IP) redirection is exposed across a network boundary, which would elevate network exposure risks."
}