Fixed
Created: Dec 8, 2025
Updated: Jun 1, 2026
Resolved Date: May 25, 2026
Found In Version: 10.22.33.1
Fix Version: 10.22.33.24
Severity: Standard
Applicable for: Wind River Linux LTS 22
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]ALSA: usb-audio: Fix potential overflow of PCM transfer buffer[EOL][EOL]The PCM stream data in USB-audio driver is transferred over USB URB[EOL]packet buffers, and each packet size is determined dynamically. The[EOL]packet sizes are limited by some factors such as wMaxPacketSize USB[EOL]descriptor. OTOH, in the current code, the actually used packet sizes[EOL]are determined only by the rate and the PPS, which may be bigger than[EOL]the size limit above. This results in a buffer overflow, as reported[EOL]by syzbot.[EOL][EOL]Basically when the limit is smaller than the calculated packet size,[EOL]it implies that something is wrong, most likely a weird USB[EOL]descriptor. So the best option would be just to return an error at[EOL]the parameter setup time before doing any further operations.[EOL][EOL]This patch introduces such a sanity check, and returns -EINVAL when[EOL]the packet size is greater than maxpacksize. The comparison with[EOL]ep->packsize[1] alone should suffice since it's always equal or[EOL]greater than ep->packsize[0].
