{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97929", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.203Z", "datePublished": "2026-09-25T10:22:46.082Z", "dateUpdated": "2026-09-25T10:22:46.082Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T10:22:46.082Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usbusx2y: validate URB actual_length in interrupt callback\n\ni_usx2y_in04_int() processes the interrupt URB data without checking\nurb->actual_length. A short transfer from a malfunctioning device\nwould cause the handler to process uninitialized heap data from the\nkmalloc-allocated in04_buf, which is then copied to the mmap-accessible\nctl_snapshot[] array.\n\nFix by using kzalloc() for in04_buf to zero-initialize the buffer,\nand adding an actual_length check to skip processing on short\ntransfers while still resubmitting the URB."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/usx2y/usbusx2y.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "c156584999bf15118f523ef6c6fedc5b21f46bd9", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2770321b358658e0a39fe39ccf6a91ee97a81931", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8f5ef203abda9dd36b2af473c7b737d544f807bd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/usx2y/usbusx2y.c"], "versions": [{"version": "2.6.12", "status": "affected"}, {"version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.3-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c156584999bf15118f523ef6c6fedc5b21f46bd9"}, {"url": "https://git.kernel.org/stable/c/b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d"}, {"url": "https://git.kernel.org/stable/c/2770321b358658e0a39fe39ccf6a91ee97a81931"}, {"url": "https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd"}], "title": "ALSA: usbusx2y: validate URB actual_length in interrupt callback", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/usx2y/usbusx2y.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c156584999bf15118f523ef6c6fedc5b21f46bd9", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "2770321b358658e0a39fe39ccf6a91ee97a81931", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "8f5ef203abda9dd36b2af473c7b737d544f807bd", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/usx2y/usbusx2y.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usbusx2y: validate URB actual_length in interrupt callback\n\ni_usx2y_in04_int() processes the interrupt URB data without checking\nurb->actual_length. A short transfer from a malfunctioning device\nwould cause the handler to process uninitialized heap data from the\nkmalloc-allocated in04_buf, which is then copied to the mmap-accessible\nctl_snapshot[] array.\n\nFix by using kzalloc() for in04_buf to zero-initialize the buffer,\nand adding an actual_length check to skip processing on short\ntransfers while still resubmitting the URB."}], "id": "CVE-2026-97929", "lastModified": "2026-09-25T11:17:20.167", "metrics": {}, "published": "2026-09-25T11:17:20.167", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2770321b358658e0a39fe39ccf6a91ee97a81931"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c156584999bf15118f523ef6c6fedc5b21f46bd9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: usbusx2y: validate URB actual_length in interrupt callback", "id": "2541060", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541060"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: usbusx2y: validate URB actual_length in interrupt callback\ni_usx2y_in04_int() processes the interrupt URB data without checking\nurb->actual_length. A short transfer from a malfunctioning device\nwould cause the handler to process uninitialized heap data from the\nkmalloc-allocated in04_buf, which is then copied to the mmap-accessible\nctl_snapshot[] array.\nFix by using kzalloc() for in04_buf to zero-initialize the buffer,\nand adding an actual_length check to skip processing on short\ntransfers while still resubmitting the URB.", "A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio driver. This vulnerability can lead to information disclosure when communicating with an attached USB device. The driver fails to verify the length of incoming data transfers during interrupt handling, allowing uninitialized kernel memory to be copied into memory buffers accessible by user applications. An attacker who connects a crafted or malfunctioning USB device can exploit this issue to expose sensitive kernel information to local users."], "name": "CVE-2026-97929", "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97929\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97929\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97929.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2-c156584999bf15118f523ef6c6fedc5b21f46bd9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2-b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2-2770321b358658e0a39fe39ccf6a91ee97a81931"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2-8f5ef203abda9dd36b2af473c7b737d544f807bd"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T14:00:13.792517+00:00", "updated": "2026-10-01T11:15:05.771890+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}