In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a… (CVE-2026-98836)

The Linux kernel ALSA line6 driver had a vulnerability where playback USB Request Blocks (URBs) were handed a buffer slice sized from the OUT endpoint, but the number of bytes written was not validated against this size. The function submit_audio_out_urb() used a frame count derived from the IN endpoint's packet length, which could be larger than the OUT endpoint's buffer. This mismatch allowed memcpy() or memset() operations to write beyond the allocated buffer, causing out-of-bounds memory writes. The USB core's validation was insufficient because max_packet_size_out only considered the low 11 bits of wMaxPacketSize, allowing up to three times the allocated slice size to be accepted. The fix involves rejecting packets that do not fit the allocated buffer slice to prevent memory corruption.

This vulnerability can cause out-of-bounds memory writes in the kernel, potentially leading to memory corruption, system instability, or crashes. There is no indication of known exploits in the wild. The impact is limited to devices using the ALSA line6 USB audio driver with specific endpoint configurations.

A fix has been implemented in the Linux kernel to reject oversized playback packets that exceed the allocated buffer size. Users should apply the official kernel updates that include this fix. No additional mitigation is required beyond applying the patch.