« Volver al listado

CVE-2026-93122

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uac: validate rate list length before storing

UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UAC_MAX_RATES entries, but the store paths do not check that the input contains at most that many tokens before writing through opts->name##s[i++].

Writing more than ten rates therefore writes past the end of the p_srates[] or c_srates[] array in struct f_uac1_opts or struct f_uac2_opts.

With CONFIG_UBSAN_BOUNDS enabled, writing an 11-entry rate list to the UAC1 p_srate attribute reports:

Leer descripción completaMostrar menos

The same reproducer against the UAC2 p_srate attribute reports:

Reject additional tokens once UAC_MAX_RATES entries have been parsed. Also keep the original kstrdup() pointer for kfree(), because strsep() advances the parsing cursor. Freeing the advanced cursor leaks the original buffer on successful parses and can free an interior pointer on some error paths.

Detalles técnicos trazas, registros y código del informe original
  UBSAN: array-index-out-of-bounds
  drivers/usb/gadget/function/f_uac1.c:1669:1
  index 10 is out of range for type 'int [10]'
  __ubsan_handle_out_of_bounds.cold
  f_uac1_opts_p_srate_store
  configfs_write_iter
  vfs_write
  ksys_write
  do_syscall_64

  UBSAN: array-index-out-of-bounds
  drivers/usb/gadget/function/f_uac2.c:2087:1
  index 10 is out of range for type 'int [10]'
  __ubsan_handle_out_of_bounds.cold
  f_uac2_opts_p_srate_store
  configfs_write_iter
  vfs_write
  ksys_write
  do_syscall_64

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de escritura fuera de límites en kernel Linux (buffer overflow) accesible con privilegios locales (PR:L). Permite ejecución de código o denegación de servicio. Vector AV:L/PR:L sin interacción del usuario confirma T1068.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramPrivileged Account ManagementFilter Network TrafficDisable or Remove Feature or ProgramCode Signing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93122",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "a7339e4f5788bd088bb0be1f96a6cce459676ed0",
              "lessThan": "3819c6f255a37c4d085ce9f264f9f11bf3c2c6bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a7339e4f5788bd088bb0be1f96a6cce459676ed0",
              "lessThan": "844d83d5964b87919b958ff48405188c6ddae9cc",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_uac1.c",
            "drivers/usb/gadget/function/f_uac2.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_uac1.c",
            "drivers/usb/gadget/function/f_uac2.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:18:06.917",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3819c6f255a37c4d085ce9f264f9f11bf3c2c6bb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/844d83d5964b87919b958ff48405188c6ddae9cc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uac: validate rate list length before storing\n\nUAC1 and UAC2 configfs rate-list attributes parse a comma-separated\nlist of sampling rates and store each parsed value in fixed-size arrays.\nThe arrays have UAC_MAX_RATES entries, but the store paths do not check\nthat the input contains at most that many tokens before writing through\nopts->name##s[i++].\n\nWriting more than ten rates therefore writes past the end of the\np_srates[] or c_srates[] array in struct f_uac1_opts or struct\nf_uac2_opts.\n\nWith CONFIG_UBSAN_BOUNDS enabled, writing an 11-entry rate list to the\nUAC1 p_srate attribute reports:\n\n  UBSAN: array-index-out-of-bounds\n  drivers/usb/gadget/function/f_uac1.c:1669:1\n  index 10 is out of range for type 'int [10]'\n  __ubsan_handle_out_of_bounds.cold\n  f_uac1_opts_p_srate_store\n  configfs_write_iter\n  vfs_write\n  ksys_write\n  do_syscall_64\n\nThe same reproducer against the UAC2 p_srate attribute reports:\n\n  UBSAN: array-index-out-of-bounds\n  drivers/usb/gadget/function/f_uac2.c:2087:1\n  index 10 is out of range for type 'int [10]'\n  __ubsan_handle_out_of_bounds.cold\n  f_uac2_opts_p_srate_store\n  configfs_write_iter\n  vfs_write\n  ksys_write\n  do_syscall_64\n\nReject additional tokens once UAC_MAX_RATES entries have been parsed.\nAlso keep the original kstrdup() pointer for kfree(), because strsep()\nadvances the parsing cursor. Freeing the advanced cursor leaks the\noriginal buffer on successful parses and can free an interior pointer on\nsome error paths."
    }
  ],
  "lastModified": "2026-09-18T18:18:21.737",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}