Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel may let USB audio data exceed limits
published 2 months ago
Summary
The Linux kernel version older than 6.6.152.1-1 can mishandle USB audio sync packets, allowing them to be larger than the hardware can handle. This could cause the audio system to become unstable or stop working. Update the kernel to the latest version or apply the provided patch to fix the issue.
What to do
- Update kernel to version 6.6.152.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kernel | <= 6.6.150.1-1 |
| Azure Linux:3 | – | kernel |
< 6.6.152.1-1 Fix: upgrade to 6.6.152.1-1
|
Original advisory text
CVE-2026-74497 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's
stride and stores the result directly in out_packet->packet_size[i]. If a
connected USB device sends an oversized sync packet, this frame count can
exceed ep->maxframesize.
The un-clamped frame count then propagates to the playback endpoint queue,
potentially driving packet transfers beyond the endpoint's hardware frame
limits.
Cap the calculated frame count against ep->maxframesize in
snd_usb_handle_sync_urb() to prevent oversized packets from entering the
playback queue.
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's
stride and stores the result directly in out_packet->packet_size[i]. If a
connected USB device sends an oversized sync packet, this frame count can
exceed ep->maxframesize.
The un-clamped frame count then propagates to the playback endpoint queue,
potentially driving packet transfers beyond the endpoint's hardware frame
limits.
Cap the calculated frame count against ep->maxframesize in
snd_usb_handle_sync_urb() to prevent oversized packets from entering the
playback queue.
References
Timeline
Published15 Aug 2026
Updated2 Oct 2026
First seen23 Sep 2026
Sources
AZL-96488 · OSV
Track software like this
Free during beta