CVE-2026-93808ALSA: usb-audio: caiaq: validate EP1 reply lengths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes. Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 523f1dce37434a9a6623bf46e7893e2b4b10ac3c builds before 91acd231f219452fa58285239f83945accad9513; 523f1dce37434a9a6623bf46e7893e2b4b10ac3c builds before 7cc6b3745a0cea697c8d0684b3094f220281a08d; from 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before add9328c91c195c494cd68a21b19e5e47a20d784; from 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before 319393151367e6626affedcdd4f7b7b0286f4246; from 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before af8a172c4f71ac30d625f2966d2389a7fa872819; 523f1dce37434a9a6623bf46e7893e2b4b10ac3c builds before 74f3c639f64fa5da4e1613149798b5089bce2807; from 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before aba30af07d4fe499b50209801eba9da8a815522f | CNA record |
References
- https://git.kernel.org/stable/c/91acd231f219452fa58285239f83945accad9513
- https://git.kernel.org/stable/c/7cc6b3745a0cea697c8d0684b3094f220281a08d
- https://git.kernel.org/stable/c/add9328c91c195c494cd68a21b19e5e47a20d784
- https://git.kernel.org/stable/c/319393151367e6626affedcdd4f7b7b0286f4246
- https://git.kernel.org/stable/c/af8a172c4f71ac30d625f2966d2389a7fa872819
- https://git.kernel.org/stable/c/74f3c639f64fa5da4e1613149798b5089bce2807
- https://git.kernel.org/stable/c/aba30af07d4fe499b50209801eba9da8a815522f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.