GHSA-7JC2-X3X6-F88W
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 12:31In the Linux kernel, the following vulnerability has been resolved:
ALSA: usbusx2y: validate URB actual_length in interrupt callback
i_usx2y_in04_int() processes the interrupt URB data without checking urb->actual_length. A short transfer from a malfunctioning device would cause the handler to process uninitialized heap data from the kmalloc-allocated in04_buf, which is then copied to the mmap-accessible ctl_snapshot[] array.
Fix by using kzalloc() for in04_buf to zero-initialize the buffer, and adding an actual_length check to skip processing on short transfers while still resubmitting the URB.
{
"affected": [],
"aliases": [
"CVE-2026-97929"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:20Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usbusx2y: validate URB actual_length in interrupt callback\n\ni_usx2y_in04_int() processes the interrupt URB data without checking\nurb-\u003eactual_length. A short transfer from a malfunctioning device\nwould cause the handler to process uninitialized heap data from the\nkmalloc-allocated in04_buf, which is then copied to the mmap-accessible\nctl_snapshot[] array.\n\nFix by using kzalloc() for in04_buf to zero-initialize the buffer,\nand adding an actual_length check to skip processing on short\ntransfers while still resubmitting the URB.",
"id": "GHSA-7jc2-x3x6-f88w",
"modified": "2026-09-25T12:31:28Z",
"published": "2026-09-25T12:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97929"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2770321b358658e0a39fe39ccf6a91ee97a81931"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c156584999bf15118f523ef6c6fedc5b21f46bd9"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.