CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths
A missing length validation in the Linux kernel's USB audio driver allows a local attacker to cause a denial of service via a malicious USB device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93808?
CVE-2026-93808 is a denial of service vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: caiaq: validate EP1 reply lengths
usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes.
Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.
Which versions are affected by CVE-2026-93808?
How do I fix CVE-2026-93808?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-93808 being exploited?
There is no known exploitation of CVE-2026-93808 in the wild and no public exploit code.
Sources
Also known as AZL-103607, BELL-CVE-2026-93808, DEBIAN-CVE-2026-93808, GHSA-qcqv-jmh6-h97c, UBUNTU-CVE-2026-93808.