{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98741 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98741 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98741 and fix it if it is affected.\n\nWhat it is: CVE-2026-98741 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98741 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98741/ (Markdown: https://insights.sbomify.com/CVE-2026-98741/index.md)","id":"CVE-2026-98741","markdown":"https://insights.sbomify.com/CVE-2026-98741/index.md","name":"CVE-2026-98741","record":{"aliases":["AZL-109242","BELL-CVE-2026-98741","DEBIAN-CVE-2026-98741","GHSA-3vm7-3m85-mm4q","UBUNTU-CVE-2026-98741"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker with access to the PCM device can trigger a buffer overflow in the ALSA ua101 driver, potentially leading to code execution or privilege escalation.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ua101: reject mismatched capture/playback packet sizes\n\ndetect_usb_format() cross-checks bSubframeSize, bBitResolution and\ntSamFreq between the capture and playback interfaces, but never relates\nthe two endpoints' wMaxPacketSize and bNrChannels.  Each playback URB\ngets a buffer of ua-\u003eplayback.max_packet_bytes, while the number of\nbytes written into it is derived from the capture stream:\ncapture_urb_complete() computes frames from the received capture packet\nand capture.frame_bytes, and start_usb_playback() and playback_work()\nmultiply that by playback.frame_bytes.\n\nA device declaring a large capture wMaxPacketSize with few capture\nchannels and a small playback wMaxPacketSize with many playback channels\ntherefore memset()s and memcpy()s past the end of the playback buffer,\nin open() of the PCM node the driver registers during probe.\nusb_submit_urb() rejects the over-long iso_frame_desc[0].length with\n-EMSGSIZE, but only after the write.\n\nReject such descriptors at probe time.  Genuine UA-101/UA-1000 hardware\ndeclares proportional packet sizes and is unaffected.\n\n  BUG: KASAN: slab-out-of-bounds in start_usb_playback (sound/usb/misc/ua101.c:586)\n  Write of size 2048 at addr ffff8881098f3c00 by task exploit/5021\n  Call Trace:\n   __asan_memset (mm/kasan/shadow.c:84)\n   start_usb_playback (sound/usb/misc/ua101.c:586)\n   playback_pcm_open (sound/usb/misc/ua101.c:679)\n   snd_pcm_open_substream (sound/core/pcm_native.c:2829)\n   snd_pcm_open (sound/core/pcm_native.c:2865 sound/core/pcm_native.c:2932)\n   snd_pcm_playback_open (sound/core/pcm_native.c:2891)\n   snd_open (sound/core/sound.c:166)\n   chrdev_open (fs/char_dev.c:411)\n   do_dentry_open (fs/open.c:996)\n   vfs_open (fs/open.c:1101)\n   path_openat (fs/namei.c:4837 fs/namei.c:5000)\n   do_file_open (fs/namei.c:5029)\n   do_sys_openat2 (fs/open.c:1417)\n   __x64_sys_openat (fs/open.c:1423 fs/open.c:1439 fs/open.c:1434)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n  The buggy address belongs to the object at ffff8881098f3c00\n   which belongs to the cache kmalloc-192 of size 192\n  The buggy address is located 0 bytes inside of\n   allocated 168-byte region [ffff8881098f3c00, ffff8881098f3ca8)","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ALSA: ua101: reject mismatched capture/playback packet sizes","id":"CVE-2026-98741","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ALSA: seq: Serialize compat port-info ioctls","id":"CVE-2026-98742"},"packages":[],"prev":{"headline":"EDAC/altera: Drop __init from ECC setup paths for re-probe safety","id":"CVE-2026-98740"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A local attacker with access to the PCM device can trigger a buffer overflow in the ALSA ua101 driver, potentially leading to code execution or privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-98741/"}