The Linux kernel ALSA usx2y driver contained a vulnerability (CVE-2026-74641) where the snd_us428ctls_vm_fault() function converted the faulting page offset into a kernel address without bounding it. The mmap handler checked only the length of the mapping, not the offset, allowing offsets beyond the single allocated page to be used. This caused the handler to map arbitrary kernel pages into user space with read-write permissions, potentially leading to kernel memory corruption or oopses. The vulnerability affects processes that can open the hwdep node of an attached US-X2Y device, which requires no special capabilities. The fix involves rejecting any offset outside the shared memory region to prevent unauthorized kernel memory access.

An unprivileged process with access to the hwdep node of a US-X2Y device could exploit this vulnerability to gain read-write access to arbitrary kernel memory pages. This could lead to kernel memory corruption, system instability, or crashes (kernel oops). There is no indication of remote exploitation or broader privilege escalation beyond the device access requirement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was resolved by bounding the mmap fault offset in the ALSA usx2y driver. Until a patch is applied, restrict access to the hwdep node of US-X2Y devices to trusted users only.