CVE-2026-98836
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
ALSA: line6: rechazar paquetes de reproducción de tamaño excesivo
A cada URB de reproducción se le asigna una porción de out.buffer de exactamente LINE6_ISO_PACKETS * max_packet_size_out bytes, dimensionada a partir del endpoint OUT, pero nunca se compara el número de bytes escritos en esa porción con dicho tamaño.
submit_audio_out_urb() toma el número de tramas de prev_fsize, que audio_in_callback() calcula a partir de la longitud del paquete recibido en el endpoint *IN*, y lo reescala con el tamaño de trama de reproducción; cuando prev_fsize sigue siendo cero, en su lugar sintetiza una longitud a partir de la frecuencia de muestreo.
Leer descripción completaMostrar menos
En un dispositivo que declara un wMaxPacketSize de IN grande y un wMaxPacketSize de OUT pequeño, el memcpy() resultante, o el memset() cuando el flujo de reproducción está inactivo, sobrepasa su porción y, como muestra el reproductor que figura más abajo, también la asignación.
usb_submit_urb() no actúa como barrera de seguridad. max_packet_size_out procede de usb_maxpacket(), que devuelve solo los 11 bits inferiores de wMaxPacketSize, mientras que el núcleo USB valida la longitud de un isócrono de alta velocidad frente a esa base multiplicada por usb_endpoint_maxp_mult(). Por tanto, se acepta una longitud de hasta tres veces el tamaño de la porción asignada, y ni siquiera un URB rechazado se rechaza hasta después de la escritura.
Se debe rechazar todo paquete que no quepa en la porción que el controlador asignó para él. Recortarlo en su lugar acortaría silenciosamente la retroalimentación de frecuencia derivada de la captura y desincronizaría los dos flujos.
Detalles técnicos trazas, registros y código del informe original
BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound/usb/line6/playback.c:229) Write of size 1024 at addr ffff888100bbd400 by task kworker/1:2/5002 Workqueue: events line6_startup_work Call Trace: __asan_memcpy (mm/kasan/shadow.c:106) submit_audio_out_urb (sound/usb/line6/playback.c:229) line6_submit_audio_out_all_urbs (sound/usb/line6/playback.c:291) line6_stream_start (sound/usb/line6/pcm.c:194) line6_pcm_acquire (sound/usb/line6/pcm.c:337) line6_startup_work (sound/usb/line6/driver.c:728) process_one_work (kernel/workqueue.c:3396) worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The buggy address belongs to the object at ffff888100bbd400 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes inside of allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98836",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7a0f55aeeb8f1fa32a119d34ddfefc6100936692",
"lessThan": "a84371be89c39ccc46c7af8b9eb15c448df9265f",
"versionType": "git"
},
{
"status": "affected",
"version": "7a0f55aeeb8f1fa32a119d34ddfefc6100936692",
"lessThan": "3f75da1e4ee699f6650d23d6897cf443b01856c7",
"versionType": "git"
},
{
"status": "affected",
"version": "7a0f55aeeb8f1fa32a119d34ddfefc6100936692",
"lessThan": "b78748424f29f07d310484b2b36afdececa74389",
"versionType": "git"
},
{
"status": "affected",
"version": "7a0f55aeeb8f1fa32a119d34ddfefc6100936692",
"lessThan": "61b0a5a114fa4552892da5c0ff2f42e63bf08c6b",
"versionType": "git"
}
],
"programFiles": [
"sound/usb/line6/playback.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"sound/usb/line6/playback.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:37.830",
"references": [
{
"url": "https://git.kernel.org/stable/c/3f75da1e4ee699f6650d23d6897cf443b01856c7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/61b0a5a114fa4552892da5c0ff2f42e63bf08c6b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a84371be89c39ccc46c7af8b9eb15c448df9265f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b78748424f29f07d310484b2b36afdececa74389",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: reject oversized playback packets\n\nEach playback URB is handed a slice of out.buffer that is exactly\nLINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT\nendpoint, but the number of bytes written into that slice is never\ncompared against it.\n\nsubmit_audio_out_urb() takes the frame count from prev_fsize, which\naudio_in_callback() derived from the *IN* endpoint's received packet\nlength, and rescales it with the playback frame size; when prev_fsize is\nstill zero it synthesizes a length from the sample rate instead. On a\ndevice declaring a large IN wMaxPacketSize and a small OUT\nwMaxPacketSize, the resulting memcpy(), or the memset() when the\nplayback stream is idle, runs past its slice and, as the reproducer\nbelow shows, beyond the allocation.\n\nusb_submit_urb() is not a backstop. max_packet_size_out comes from\nusb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize,\nwhile USB core validates a high-speed isochronous length against that\nbase scaled by usb_endpoint_maxp_mult(). A length of up to three times\nthe allocated slice is therefore accepted, and even a rejected URB is\nonly rejected after the write.\n\nReject a packet that does not fit the slice the driver allocated for it.\nClamping it instead would silently shorten the capture-derived rate\nfeedback and desynchronize the two streams.\n\n BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound/usb/line6/playback.c:229)\n Write of size 1024 at addr ffff888100bbd400 by task kworker/1:2/5002\n Workqueue: events line6_startup_work\n Call Trace:\n __asan_memcpy (mm/kasan/shadow.c:106)\n submit_audio_out_urb (sound/usb/line6/playback.c:229)\n line6_submit_audio_out_all_urbs (sound/usb/line6/playback.c:291)\n line6_stream_start (sound/usb/line6/pcm.c:194)\n line6_pcm_acquire (sound/usb/line6/pcm.c:337)\n line6_startup_work (sound/usb/line6/driver.c:728)\n process_one_work (kernel/workqueue.c:3396)\n worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n The buggy address belongs to the object at ffff888100bbd400\n which belongs to the cache kmalloc-256 of size 256\n The buggy address is located 0 bytes inside of\n allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)"
}
],
"lastModified": "2026-10-19T10:19:47.630",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}