In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd… (CVE-2026-98769)

The vulnerability in the Linux kernel affects the usb gadget function f_uac1_legacy, where the low nibble of ctrl->bRequest is used as an index into a 5-element array con->data[]. However, the code does not validate that this index is less than 5, allowing indices from 5 to 15 to cause out-of-bounds reads or writes up to 44 bytes beyond the array boundary on the heap. This occurs in generic_set_cmd() and generic_get_cmd() functions, which are called from an IRQ completion handler. A malicious USB host can exploit this by sending crafted class-specific SET_CUR or GET_CUR requests with arbitrary bRequest values. The fix involves adding an ARRAY_SIZE() guard to validate the index before accessing the array.

Heap out-of-bounds read or write can occur, potentially leading to memory corruption. This could affect system stability or security, but no specific exploitation details or known exploits in the wild are reported.

A fix has been applied to the Linux kernel source code by adding an ARRAY_SIZE() guard to validate the bRequest index in generic_set_cmd() and generic_get_cmd(). Users should update their Linux kernel to a version that includes this patch once available. No other mitigation steps are indicated.