# CVE-2026-98265: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity

> A malicious USB device can trigger a slab-out-of-bounds write in the Linux kernel ALSA USB audio driver, potentially leading to code execution or system crash.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 6 Oct 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-106476, BELL-CVE-2026-98265, DEBIAN-CVE-2026-98265, GHSA-qghg-5w48-4c7c, UBUNTU-CVE-2026-98265

## What is CVE-2026-98265?

CVE-2026-98265 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity

data_ep_set_params() allocates each data URB for exactly u->packets
isochronous frames, so urb->iso_frame_desc[] has u->packets slots and
ctx->packets is the driver's only record of that limit. For an implicit
feedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the
sync source's packet count, which is calculated independently from the
capture endpoint's parameters. When that count is larger,
prepare_playback_urb() and prepare_silent_urb() can write
iso_frame_desc[] past the allocation; their existing bounds limit payload
bytes, not the descriptor index.

The reproducer uses a high-speed UAC2 device declaring bInterval 1 for
implicit feedback capture (8 packets) and bInterval 4 for playback
(1 packet). On the first capture completion after the stream starts, it
accesses seven descriptors spanning 112 bytes beyond the one-packet URB:

  BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560)
  Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178
   prepare_playback_urb (sound/usb/pcm.c:1560)
   prepare_outbound_urb (sound/usb/endpoint.c:340)
   snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501)
   snd_complete_urb (sound/usb/endpoint.c:1834)
   __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)
   usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)
   vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107)
   kthread (kernel/kthread.c:436)
  The buggy address belongs to the object at ffff88801e696a00
   which belongs to the cache kmalloc-256 of size 256
  The buggy address is located 0 bytes to the right of
   allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)

Record the allocated packet count per endpoint and clamp both the adopted
count and the packet-size copy to it. Fold the Format Type II delimiter
into urb_packs before the allocation loop so the recorded limit matches
every URB.

## Which versions are affected by CVE-2026-98265?


## How do I fix CVE-2026-98265?

Apply the vendor's patch.

## Is CVE-2026-98265 being exploited?

There is no known exploitation of CVE-2026-98265 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98265 and fix it if it is affected.

What it is: CVE-2026-98265 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2026-98265 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98265/ (Markdown: https://insights.sbomify.com/CVE-2026-98265/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98265
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98265
- OSV: https://osv.dev/vulnerability/CVE-2026-98265

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98265/
Summaries are generated and may contain mistakes; the official description above is the record.