In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detect_usb_format()… (CVE-2026-98741)

The Linux kernel ALSA ua101 driver contained a vulnerability where detect_usb_format() cross-checked some USB audio interface parameters but did not verify the relationship between the capture and playback endpoints' maximum packet sizes and channel counts. This allowed a device with a large capture wMaxPacketSize and few channels combined with a small playback wMaxPacketSize and many channels to cause memset() and memcpy() operations to write beyond the allocated playback buffer during PCM node open. The kernel's usb_submit_urb() rejected over-long packets only after the write occurred. The fix involves rejecting such mismatched descriptors at probe time, preventing the out-of-bounds memory access. Genuine UA-101/UA-1000 devices with proportional packet sizes are not affected.

The vulnerability results in out-of-bounds memory writes in kernel space, which can cause memory corruption and potentially lead to system instability or escalation of privileges if exploited. The issue occurs during the open() call of the PCM node for the affected USB audio device driver. However, genuine UA-101/UA-1000 hardware is not affected. There are no known exploits in the wild.

A fix has been implemented in the Linux kernel to reject mismatched capture/playback packet sizes at probe time, preventing the out-of-bounds writes. Users should update to a Linux kernel version that includes this fix. No additional mitigation is required for genuine UA-101/UA-1000 hardware as they are unaffected.