CVE-2026-93808

ALSA: usb-audio: caiaq: validate EP1 reply lengths

State: Published
Severity: Not scored
Published: Sep 24, 2026
Updated: Oct 3, 2026
Reserved: Sep 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: caiaq: validate EP1 reply lengths

usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes.

Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before 91acd231f219452fa58285239f83945accad9513Affected 523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before 7cc6b3745a0cea697c8d0684b3094f220281a08dAffected 523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before add9328c91c195c494cd68a21b19e5e47a20d784Affected 523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before 319393151367e6626affedcdd4f7b7b0286f4246Affected 523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before af8a172c4f71ac30d625f2966d2389a7fa872819Affected 523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before 74f3c639f64fa5da4e1613149798b5089bce2807Affected 523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before aba30af07d4fe499b50209801eba9da8a815522fAffected
LinuxLinux	2.6.22Affected before 2.6.22Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before 91acd231f219452fa58285239f83945accad9513Affected
523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before 7cc6b3745a0cea697c8d0684b3094f220281a08dAffected
523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before add9328c91c195c494cd68a21b19e5e47a20d784Affected
523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before 319393151367e6626affedcdd4f7b7b0286f4246Affected
523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before af8a172c4f71ac30d625f2966d2389a7fa872819Affected
523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before 74f3c639f64fa5da4e1613149798b5089bce2807Affected
523f1dce37434a9a6623bf46e7893e2b4b10ac3c to before aba30af07d4fe499b50209801eba9da8a815522fAffected

LinuxLinux

2.6.22Affected
before 2.6.22Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.