CVE-2026-23208 ALSA: usb-audio: Prevent excessive number of frames

High 7.8 Published 14 Feb 2026 Updated 21 Oct 2026

A local attacker can trigger an out-of-bounds write in the ALSA USB audio driver, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-23208?

CVE-2026-23208 is a high-severity memory corruption vulnerability in Linux kernel, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Prevent excessive number of frames

In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer size for each data URB is maxpacksize * packets, which in this example is 40 * 6 = 240; When the user performs a write operation to send audio data into the ALSA PCM playback stream, the calculated number of frames is packsize[0] * packets = 264, which exceeds the allocated URB buffer size, triggering the out-of-bounds (OOB) issue reported by syzbot [1].

Added a check for the number of single data URB frames when calculating the number of frames to prevent [1].

[1] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506 Call Trace: copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611 prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333

Weakness: CWE-787

Which versions are affected by CVE-2026-23208?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-23208?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-23208 being exploited?

There is no known exploitation of CVE-2026-23208 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-77712, BELL-CVE-2026-23208, DEBIAN-CVE-2026-23208, GHSA-gmr7-w89v-rr2q, ROOT-OS-DEBIAN-11-CVE-2026-23208, ROOT-OS-DEBIAN-12-CVE-2026-23208 and 4 more.