CVE-2026-74500: ALSA: usb-audio: fix stack info leak in RME Digiface status

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix stack info leak in RME Digiface status

snd_rme_digiface_read_status() reads a four-word status block from the
device into an uninitialised on-stack __le32 buf[4] and, whenever the
vendor control-IN transfer does not return a negative error, copies all
four words into the caller's status[].

snd_usb_ctl_msg() copies the full requested size back into the caller's
buffer regardless of how many bytes the data stage actually delivered:

	buf = kmemdup(data, size, GFP_KERNEL);
	err = usb_control_msg(dev, pipe, request, requesttype,
			      value, index, buf, size, timeout);
	memcpy(data, buf, size);

usb_control_msg() returns the transferred length on a short control-IN,
which is a non-negative value, and writes only that many bytes.  The
remainder of the copy back is the kmemdup()ed image of the caller's
buffer, so a device answering with a short data stage leaves the
trailing words of buf[] holding leftover kernel stack.  The only guard
in the caller is err < 0, so those words are stored into status[].

They then reach user space: snd_rme_digiface_get_status_val() selects a
16-bit halfword of status[] per the control's reg/mask, and the eight
Digiface status controls together expose the whole 16-byte frame to an
unprivileged reader of /dev/snd/controlC*.

Zero-initialise the buffer so a short read yields zeros instead of stack
residue.  This mirrors snd_rme_get_status1(), which already clears its
output word before the same kind of vendor read.

Discovered by XBOW, triaged by Baul Lee <[email protected]>

The Linux kernel CVE team has assigned CVE-2026-74500 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 611a96f6acf2e74fe28cb90908a9c183862348ce and fixed in 6.12.103 with commit b3a346d5c99dd73cf84711f2a43e42691990efd2
	Issue introduced in 6.12 with commit 611a96f6acf2e74fe28cb90908a9c183862348ce and fixed in 6.18.44 with commit 7ba01e0d3539d9cf0aef3e82938f1648147744cc
	Issue introduced in 6.12 with commit 611a96f6acf2e74fe28cb90908a9c183862348ce and fixed in 7.1.8 with commit 98dbfbb38e297c25c5b0af4a9018d71ac25e8554
	Issue introduced in 6.12 with commit 611a96f6acf2e74fe28cb90908a9c183862348ce and fixed in 7.2-rc6 with commit 441aaad150c57edaf57ee482a79a3bf4c5b7e353
	Issue introduced in 6.10.14 with commit 3089703ab71484a8b9a7641051181d11d60f870c
	Issue introduced in 6.11.3 with commit 50f63f11a6ddaa0d34574df72b3fa6ee257c057d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74500
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/usb/mixer_quirks.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b3a346d5c99dd73cf84711f2a43e42691990efd2
	https://git.kernel.org/stable/c/7ba01e0d3539d9cf0aef3e82938f1648147744cc
	https://git.kernel.org/stable/c/98dbfbb38e297c25c5b0af4a9018d71ac25e8554
	https://git.kernel.org/stable/c/441aaad150c57edaf57ee482a79a3bf4c5b7e353