In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize. The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits. Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
References
Link Providers
https://git.kernel.org/stable/c/2db4535d6af79276a64449201c5be5feffb31c64 cve-icon cve-icon
https://git.kernel.org/stable/c/53f0aa37eb945f3c983f61d12fc35eb33debb8a9 cve-icon cve-icon
https://git.kernel.org/stable/c/56ac3e7c90f6b45969c3fd07a98fad760ffd6901 cve-icon cve-icon
https://git.kernel.org/stable/c/8d7a30c50c2e58a6839634ed0acde14466d1dc61 cve-icon cve-icon
https://git.kernel.org/stable/c/be97fea7451d758881b95af78e900dd0d58a382a cve-icon cve-icon
History

Sat, 15 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
CWE-400

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize. The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits. Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue.
Title ALSA: usb-audio: Clamp frame size in implicit-feedback mode
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T12:27:24.494Z

Reserved: 2026-08-15T05:44:03.907Z

Link: CVE-2026-74497

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:17:54.657

Modified: 2026-08-15T13:17:54.657

Link: CVE-2026-74497

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T15:15:03Z