CVE-2026-74682: ALSA: usb-audio: fix OOB write on Type II inbound URBs

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write on Type II inbound URBs

data_ep_set_params() sizes each URB transfer buffer before it adds the
Format Type II transfer delimiter:

	u->packets = urb_packs;
	u->buffer_size = maxsize * u->packets;

	if (fmt->fmt_type == UAC_FORMAT_TYPE_II)
		u->packets++; /* for transfer delimiter */
	u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);

buffer_size is computed from the pre-increment packet count and never
recomputed, so for a Type II endpoint the buffer is one packet short of
the packet count the URB is built with.

prepare_inbound_urb() then lays out one iso frame per packet and never
consults buffer_size:

	offs = 0;
	for (i = 0; i < urb_ctx->packets; i++) {
		urb->iso_frame_desc[i].offset = offs;
		urb->iso_frame_desc[i].length = ep->curpacksize;
		offs += ep->curpacksize;
	}

	urb->transfer_buffer_length = offs;
	urb->number_of_packets = urb_ctx->packets;

The last descriptor therefore points one packet past the end of the
transfer buffer, where the host controller writes device data on every
inbound transfer.  prepare_silent_urb() and prepare_playback_urb() bound
their fill loops by ctx->buffer_size, so only capture is affected.

fmt_type comes from the device's audio streaming descriptors, so any
device advertising a Type II capture format hits this once userspace sets
hw_params on the stream.

KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report
per inbound transfer:

  BUG: KASAN: slab-out-of-bounds in dummy_timer
  Write of size 64 at addr ffff0000186171c0 by task cons02/166
   __asan_memcpy
   dummy_timer
   hrtimer_run_softirq
  Allocated by task 166:
   usb_alloc_coherent
   snd_usb_endpoint_set_params
  The buggy address is located 0 bytes to the right of
   allocated 64-byte region [ffff000018617180, ffff0000186171c0)

Compute buffer_size after the delimiter packet has been accounted for,
and bound the fill loop by buffer_size, as prepare_silent_urb() already
does on the outbound side.  This grows every Type II URB allocation by
one maxsize packet.

Discovered by XBOW, triaged by Baul Lee <[email protected]>

The Linux kernel CVE team has assigned CVE-2026-74682 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.5 with commit 8fdff6a319e7dac757c558bd283dc4577e68cde7 and fixed in 5.10.265 with commit 6af5f29af7711233ae68d3b25c15d67478468900
	Issue introduced in 3.5 with commit 8fdff6a319e7dac757c558bd283dc4577e68cde7 and fixed in 5.15.216 with commit f1fbb50b99311b35c2e85cc70341d62082dca4b5
	Issue introduced in 3.5 with commit 8fdff6a319e7dac757c558bd283dc4577e68cde7 and fixed in 6.1.183 with commit 137bf034740e5a2734794908d0aff1e0bd7cee6e
	Issue introduced in 3.5 with commit 8fdff6a319e7dac757c558bd283dc4577e68cde7 and fixed in 6.6.152 with commit 6607f85242577f33d4540a0d1f4a6137f5367058
	Issue introduced in 3.5 with commit 8fdff6a319e7dac757c558bd283dc4577e68cde7 and fixed in 6.12.104 with commit ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a
	Issue introduced in 3.5 with commit 8fdff6a319e7dac757c558bd283dc4577e68cde7 and fixed in 6.18.45 with commit 0a235379825e1a6194e43861ee6658e5fc35686d
	Issue introduced in 3.5 with commit 8fdff6a319e7dac757c558bd283dc4577e68cde7 and fixed in 7.1.9 with commit d3ed4e6321bb453757044cb9e5ecb30a33f04903
	Issue introduced in 3.5 with commit 8fdff6a319e7dac757c558bd283dc4577e68cde7 and fixed in 7.2 with commit 69ee44e1a23be62318189dc4b37fa4ad94053269

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74682
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/usb/endpoint.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900
	https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5
	https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e
	https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058
	https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a
	https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d
	https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903
	https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269