VulnerabilityPublished 18 Oct 2026Updated 21 Oct 2026

CVE-2026-98836: Linux kernel · ALSA: line6: reject oversized playback packets

Source GCVE Database

Authoritative record:CVE-2026-98836

Not known to be exploited · fixed in b78748424f29f07d310484b2b36afdececa74389 : patch Linux kernel soon.

Data as of 26 Oct 2026, 13:47 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in b78748424f29f07d310484b2b36afdececa74389, a84371be89c39ccc46c7af8b9eb15c448df9265f, 933d8ac23388eb208ea195231d682dce0bec86ca +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-xfm3-rq9f-jfc7

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 7a0f55aeeb8f1fa32a119d34ddfefc6100936692, < b78748424f29f07d310484b2b36afdececa74389	Fixed in b78748424f29f07d310484b2b36afdececa74389
LinuxLinux	Affected ≥ 7a0f55aeeb8f1fa32a119d34ddfefc6100936692, < a84371be89c39ccc46c7af8b9eb15c448df9265f	Fixed in a84371be89c39ccc46c7af8b9eb15c448df9265f
LinuxLinux	Affected ≥ 7a0f55aeeb8f1fa32a119d34ddfefc6100936692, < 933d8ac23388eb208ea195231d682dce0bec86ca	Fixed in 933d8ac23388eb208ea195231d682dce0bec86ca
LinuxLinux	Affected ≥ 7a0f55aeeb8f1fa32a119d34ddfefc6100936692, < 61b0a5a114fa4552892da5c0ff2f42e63bf08c6b	Fixed in 61b0a5a114fa4552892da5c0ff2f42e63bf08c6b
LinuxLinux	Affected ≥ 7a0f55aeeb8f1fa32a119d34ddfefc6100936692, < 3f75da1e4ee699f6650d23d6897cf443b01856c7	Fixed in 3f75da1e4ee699f6650d23d6897cf443b01856c7
LinuxLinux	Affected =4.9	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to reject oversized playback packets that exceed the allocated buffer size. Users should apply the official kernel updates that include this fix. No additional mitigation is required beyond applying the patch.

Description

A vulnerability in the Linux kernel ALSA line6 driver allows oversized playback packets to be processed without proper size validation, leading to out-of-bounds memory writes. This occurs because the playback URB buffer size is not properly checked against the actual data length, potentially causing memory corruption. The issue arises when a device has a large IN endpoint max packet size and a smaller OUT endpoint max packet size, allowing writes beyond the allocated buffer. The vulnerability has been resolved by rejecting packets that exceed the allocated buffer size.

Impact

This vulnerability can cause out-of-bounds memory writes in the kernel, potentially leading to memory corruption, system instability, or crashes. There is no indication of known exploits in the wild. The impact is limited to devices using the ALSA line6 USB audio driver with specific endpoint configurations.

Summary

The Linux kernel ALSA line6 driver had a vulnerability where playback USB Request Blocks (URBs) were handed a buffer slice sized from the OUT endpoint, but the number of bytes written was not validated against this size. The function submit_audio_out_urb() used a frame count derived from the IN endpoint's packet length, which could be larger than the OUT endpoint's buffer. This mismatch allowed memcpy() or memset() operations to write beyond the allocated buffer, causing out-of-bounds memory writes. The USB core's validation was insufficient because max_packet_size_out only considered the low 11 bits of wMaxPacketSize, allowing up to three times the allocated slice size to be accepted. The fix involves rejecting packets that do not fit the allocated buffer slice to prevent memory corruption.

References

Community reviews

Loading reviews…