The Linux kernel ALSA usb-audio driver had a flaw in data_ep_set_params() where the buffer_size for URB transfers was computed before incrementing the packet count for the Type II transfer delimiter. Consequently, the allocated buffer was one packet short. During inbound URB preparation, the iso frame descriptors were set up for the incremented packet count, causing the last descriptor to point beyond the buffer boundary. This led to out-of-bounds writes on inbound capture transfers for devices using Type II audio formats. The fix involves computing buffer_size after accounting for the delimiter packet and bounding the fill loop by buffer_size, preventing the out-of-bounds write. The issue was discovered by XBOW and triaged by Baul Lee.

This vulnerability causes an out-of-bounds write in the kernel memory during inbound USB audio capture streams on devices using Type II audio formats. Such memory corruption could potentially lead to system instability, crashes, or escalation of privileges depending on the context and exploitation, though no specific exploit or active attacks are reported. The flaw affects the ALSA usb-audio driver in the Linux kernel and is triggered when userspace sets hardware parameters on affected streams.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the buffer size calculation and bounding the fill loop to prevent out-of-bounds writes. Users should update their Linux kernel to a version that includes this patch. Since this is a kernel-level issue, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.