CVE-2026-97929 ALSA: usbusx2y: validate URB actual_length in interrupt callback
A malicious USB device can trigger uninitialized memory disclosure in the ALSA usbusx2y driver, allowing local attackers to read kernel heap data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97929?
CVE-2026-97929 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usbusx2y: validate URB actual_length in interrupt callback
i_usx2y_in04_int() processes the interrupt URB data without checking urb->actual_length. A short transfer from a malfunctioning device would cause the handler to process uninitialized heap data from the kmalloc-allocated in04_buf, which is then copied to the mmap-accessible ctl_snapshot[] array.
Fix by using kzalloc() for in04_buf to zero-initialize the buffer, and adding an actual_length check to skip processing on short transfers while still resubmitting the URB.
Which versions are affected by CVE-2026-97929?
How do I fix CVE-2026-97929?
Apply the vendor's patch.
Is CVE-2026-97929 being exploited?
There is no known exploitation of CVE-2026-97929 in the wild and no public exploit code.
Sources
Also known as AZL-104387, BELL-CVE-2026-97929, DEBIAN-CVE-2026-97929, GHSA-7jc2-x3x6-f88w, UBUNTU-CVE-2026-97929.