{
  "cveId": "CVE-2026-98836",
  "url": "https://patchblox.com/security/cve/CVE-2026-98836",
  "summary": "CVE-2026-98836 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2026-98836, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ALSA: line6: reject oversized playback packets",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ALSA: line6: reject oversized playback packets  Each playback URB is handed a slice of out.buffer that is exactly LINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT endpoint, but the number of bytes written into that slice is never compared against it.  submit_audio_out_urb() takes the frame count from prev_fsize, which audio_in_callback() derived from the *IN* endpoint\u0027s received packet length, and rescales it with the playback frame size; when prev_fsize is still zero it synthesizes a length from the sample rate instead.  On a device declaring a large IN wMaxPacketSize and a small OUT wMaxPacketSize, the resulting memcpy(), or the memset() when the playback stream is idle, runs past its slice and, as the reproducer below shows, beyond the allocation.  usb_submit_urb() is not a backstop.  max_packet_size_out comes from usb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize, while USB core validates a high-speed isochronous length against that base scaled by usb_endpoint_maxp_mult().  A length of up to three times the allocated slice is therefore accepted, and even a rejected URB is only rejected after the write.  Reject a packet that does not fit the slice the driver allocated for it. Clamping it instead would silently shorten the capture-derived rate feedback and desynchronize the two streams.    BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound/usb/line6/playback.c:229)   Write of size 1024 at addr ffff888100bbd400 by task kworker/1:2/5002   Workqueue: events line6_startup_work   Call Trace:    __asan_memcpy (mm/kasan/shadow.c:106)    submit_audio_out_urb (sound/usb/line6/playback.c:229)    line6_submit_audio_out_all_urbs (sound/usb/line6/playback.c:291)    line6_stream_start (sound/usb/line6/pcm.c:194)    line6_pcm_acquire (sound/usb/line6/pcm.c:337)    line6_startup_work (sound/usb/line6/driver.c:728)    process_one_work (kernel/workqueue.c:3396)    worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)    kthread (kernel/kthread.c:436)    ret_from_fork (arch/x86/kernel/process.c:158)    ret_from_fork_asm (arch/x86/entry/entry_64.S:245)    The buggy address belongs to the object at ffff888100bbd400    which belongs to the cache kmalloc-256 of size 256   The buggy address is located 0 bytes inside of    allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)",
  "published": "2026-10-18T16:17:37Z",
  "severity": "Moderate",
  "cvss": 6.8,
  "epss": 0.00176,
  "epssPercentile": 0.07204,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98836",
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1.150700.17.51.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7_Update_24",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.15.3.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-98836",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98836",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98836",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98836",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.113-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-98836",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98836",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}