{"id":"CVE-2026-98836","aliases":[],"cve":{"records":[{"id":"CVE-2026-98836","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.372Z","published":"2026-10-18T15:49:51.823Z","modified":"2026-10-30T12:40:05.522Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:40:05.522Z"}],"references":[{"url":"https://git.kernel.org/stable/c/48c76820dd8858ce60a6e42519141ebcf3dfeebf","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/7f31587e26e1d4735924bc324e7fa506d85de150","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/e3b68b1d92f279e203923dc8bf45c8860e5b5985","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/933d8ac23388eb208ea195231d682dce0bec86ca","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/a84371be89c39ccc46c7af8b9eb15c448df9265f","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/3f75da1e4ee699f6650d23d6897cf443b01856c7","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/b78748424f29f07d310484b2b36afdececa74389","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/61b0a5a114fa4552892da5c0ff2f42e63bf08c6b","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"ALSA: line6: reject oversized playback packets","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: reject oversized playback packets\n\nEach playback URB is handed a slice of out.buffer that is exactly\nLINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT\nendpoint, but the number of bytes written into that slice is never\ncompared against it.\n\nsubmit_audio_out_urb() takes the frame count from prev_fsize, which\naudio_in_callback() derived from the *IN* endpoint's received packet\nlength, and rescales it with the playback frame size; when prev_fsize is\nstill zero it synthesizes a length from the sample rate instead.  On a\ndevice declaring a large IN wMaxPacketSize and a small OUT\nwMaxPacketSize, the resulting memcpy(), or the memset() when the\nplayback stream is idle, runs past its slice and, as the reproducer\nbelow shows, beyond the allocation.\n\nusb_submit_urb() is not a backstop.  max_packet_size_out comes from\nusb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize,\nwhile USB core validates a high-speed isochronous length against that\nbase scaled by usb_endpoint_maxp_mult().  A length of up to three times\nthe allocated slice is therefore accepted, and even a rejected URB is\nonly rejected after the write.\n\nReject a packet that does not fit the slice the driver allocated for it.\nClamping it instead would silently shorten the capture-derived rate\nfeedback and desynchronize the two streams.\n\n  BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound/usb/line6/playback.c:229)\n  Write of size 1024 at addr ffff888100bbd400 by task kworker/1:2/5002\n  Workqueue: events line6_startup_work\n  Call Trace:\n   __asan_memcpy (mm/kasan/shadow.c:106)\n   submit_audio_out_urb (sound/usb/line6/playback.c:229)\n   line6_submit_audio_out_all_urbs (sound/usb/line6/playback.c:291)\n   line6_stream_start (sound/usb/line6/pcm.c:194)\n   line6_pcm_acquire (sound/usb/line6/pcm.c:337)\n   line6_startup_work (sound/usb/line6/driver.c:728)\n   process_one_work (kernel/workqueue.c:3396)\n   worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n  The buggy address belongs to the object at ffff888100bbd400\n   which belongs to the cache kmalloc-256 of size 256\n  The buggy address is located 0 bytes inside of\n   allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)","score":null,"severity":"unknown","published":"2026-10-18T15:49:51.823Z","modified":"2026-10-30T12:40:05.522Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"7a0f55aeeb8f1fa32a119d34ddfefc6100936692","status":"affected","lessThan":"48c76820dd8858ce60a6e42519141ebcf3dfeebf","versionType":"git"},{"version":"7a0f55aeeb8f1fa32a119d34ddfefc6100936692","status":"affected","lessThan":"7f31587e26e1d4735924bc324e7fa506d85de150","versionType":"git"},{"version":"7a0f55aeeb8f1fa32a119d34ddfefc6100936692","status":"affected","lessThan":"e3b68b1d92f279e203923dc8bf45c8860e5b5985","versionType":"git"},{"version":"7a0f55aeeb8f1fa32a119d34ddfefc6100936692","status":"affected","lessThan":"933d8ac23388eb208ea195231d682dce0bec86ca","versionType":"git"},{"version":"7a0f55aeeb8f1fa32a119d34ddfefc6100936692","status":"affected","lessThan":"a84371be89c39ccc46c7af8b9eb15c448df9265f","versionType":"git"},{"version":"7a0f55aeeb8f1fa32a119d34ddfefc6100936692","status":"affected","lessThan":"3f75da1e4ee699f6650d23d6897cf443b01856c7","versionType":"git"},{"version":"7a0f55aeeb8f1fa32a119d34ddfefc6100936692","status":"affected","lessThan":"b78748424f29f07d310484b2b36afdececa74389","versionType":"git"},{"version":"7a0f55aeeb8f1fa32a119d34ddfefc6100936692","status":"affected","lessThan":"61b0a5a114fa4552892da5c0ff2f42e63bf08c6b","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98836"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"4.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.9","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98836"}],"remediation":[],"references":["https://git.kernel.org/stable/c/48c76820dd8858ce60a6e42519141ebcf3dfeebf","https://git.kernel.org/stable/c/7f31587e26e1d4735924bc324e7fa506d85de150","https://git.kernel.org/stable/c/e3b68b1d92f279e203923dc8bf45c8860e5b5985","https://git.kernel.org/stable/c/933d8ac23388eb208ea195231d682dce0bec86ca","https://git.kernel.org/stable/c/a84371be89c39ccc46c7af8b9eb15c448df9265f","https://git.kernel.org/stable/c/3f75da1e4ee699f6650d23d6897cf443b01856c7","https://git.kernel.org/stable/c/b78748424f29f07d310484b2b36afdececa74389","https://git.kernel.org/stable/c/61b0a5a114fa4552892da5c0ff2f42e63bf08c6b"],"sources":[{"name":"CVE","id":"CVE-2026-98836","modified":"2026-10-30T12:40:05.522Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98836"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T13:09:37.246Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Linux kernel is vulnerable due to oversized playback packets in the ALSA line6 driver. Affected versions include those prior to 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.56, and 7.2.10. The vulnerability may cause a slab-out-of-bounds write.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T17:36:54.667Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-98836"}]}}