{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ALSA: usb-audio: fix OOB write on Type II inbound URBs  data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter:  \tu-\u003epackets = urb_packs; \tu-\u003ebuffer_size = maxsize * u-\u003epackets;  \tif (fmt-\u003efmt_type == UAC_FORMAT_TYPE_II) \t\tu-\u003epackets++; /* for transfer delimiter */ \tu-\u003eurb = usb_alloc_urb(u-\u003epackets, GFP_KERNEL);  buffer_size is computed from the pre-increment packet count and never recomputed, so for a Type II endpoint the buffer is one packet short of the packet count the URB is built with.  prepare_inbound_urb() then lays out one iso frame per packet and never consults buffer_size:  \toffs = 0; \tfor (i = 0; i \u003c urb_ctx-\u003epackets; i++) { \t\turb-\u003eiso_frame_desc[i].offset = offs; \t\turb-\u003eiso_frame_desc[i].length = ep-\u003ecurpacksize; \t\toffs += ep-\u003ecurpacksize; \t}  \turb-\u003etransfer_buffer_length = offs; \turb-\u003enumber_of_packets = urb_ctx-\u003epackets;  The last descriptor therefore points one packet past the end of the transfer buffer, where the host controller writes device data on every inbound transfer.  prepare_silent_urb() and prepare_playback_urb() bound their fill loops by ctx-\u003ebuffer_size, so only capture is affected.  fmt_type comes from the device's audio streaming descriptors, so any device advertising a Type II capture format hits this once userspace sets hw_params on the stream.  KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report per inbound transfer:    BUG: KASAN: slab-out-of-bounds in dummy_timer   Write of size 64 at addr ffff0000186171c0 by task cons02/166    __asan_memcpy    dummy_timer    hrtimer_run_softirq   Allocated by task 166:    usb_alloc_coherent    snd_usb_endpoint_set_params   The buggy address is located 0 bytes to the right of    allocated 64-byte region [ffff000018617180, ffff0000186171c0)  Compute buffer_size after the delimiter packet has been accounted for, and bound the fill loop by buffer_size, as prepare_silent_urb() already does on the outbound side.  This grows every Type II URB allocation by one maxsize packet.  Discovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e",
  "id": "DEBIAN-CVE-2026-74682",
  "modified": "2026-09-19T21:47:32.110620863Z",
  "published": "2026-08-22T16:16:42.480Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74682"
    }
  ],
  "upstream": [
    "CVE-2026-74682"
  ]
}