Medium · published May 27, 2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
parse_uac2_sample_rate_range() caps the number of enumerated
rates at MAX_NR_RATES, but it only breaks out of the current
rate loop. A malformed UAC2 RANGE response with additional
triplets continues parsing the remaining triplets and repeatedly
prints "invalid uac2 rates" while probe still holds
register_mutex.
Stop the whole parse once the cap is reached and return the
number of rates collected so far.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.0.81, < 3.1 | 3.1 |
| linux/linux_kernel | ≥ 3.2.47, < 5.10.258 | 5.10.258 |
| linux/linux_kernel | ≥ 5.11, < 5.15.209 | 5.15.209 |
| linux/linux_kernel | ≥ 5.16, < 6.1.175 | 6.1.175 |
| linux/linux_kernel | ≥ 6.2, < 6.6.140 | 6.6.140 |
| linux/linux_kernel | ≥ 6.7, < 6.12.86 | 6.12.86 |
| linux/linux_kernel | ≥ 6.13, < 6.18.27 | 6.18.27 |
| linux/linux_kernel | ≥ 6.19, < 7.0.4 | 7.0.4 |