---
id: CVE-2026-98836
title: 'ALSA: line6: reject oversized playback packets'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: line6: reject oversized playback packets

  Each playback URB is handed a slice of out.buffer that is exactly
  LINE6_ISO_PACKETS * max_packet_size_out bytes, sized f…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7a0f55aeeb8f1fa32a119d34ddfefc6100936692 <
    a84371be89c39ccc46c7af8b9eb15c448df9265f
  - >-
    Linux >= 7a0f55aeeb8f1fa32a119d34ddfefc6100936692 <
    3f75da1e4ee699f6650d23d6897cf443b01856c7
  - >-
    Linux >= 7a0f55aeeb8f1fa32a119d34ddfefc6100936692 <
    b78748424f29f07d310484b2b36afdececa74389
  - >-
    Linux >= 7a0f55aeeb8f1fa32a119d34ddfefc6100936692 <
    61b0a5a114fa4552892da5c0ff2f42e63bf08c6b
  - Linux 4.9
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:49:51.823Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98836'
references:
  - url: 'https://git.kernel.org/stable/c/a84371be89c39ccc46c7af8b9eb15c448df9265f'
  - url: 'https://git.kernel.org/stable/c/3f75da1e4ee699f6650d23d6897cf443b01856c7'
  - url: 'https://git.kernel.org/stable/c/b78748424f29f07d310484b2b36afdececa74389'
  - url: 'https://git.kernel.org/stable/c/61b0a5a114fa4552892da5c0ff2f42e63bf08c6b'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.468Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: line6: reject oversized playback packets

Each playback URB is handed a slice of out.buffer that is exactly
LINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT
endpoint, but the number of bytes written into that slice is never
compared against it.

submit_audio_out_urb() takes the frame count from prev_fsize, which
audio_in_callback() derived from the *IN* endpoint's received packet
length, and rescales it with the playback frame size; when prev_fsize is
still zero it synthesizes a length from the sample rate instead.  On a
device declaring a large IN wMaxPacketSize and a small OUT
wMaxPacketSize, the resulting memcpy(), or the memset() when the
playback stream is idle, runs past its slice and, as the reproducer
below shows, beyond the allocation.

usb_submit_urb() is not a backstop.  max_packet_size_out comes from
usb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize,
while USB core validates a high-speed isochronous length against that
base scaled by usb_endpoint_maxp_mult().  A length of up to three times
the allocated slice is therefore accepted, and even a rejected URB is
only rejected after the write.

Reject a packet that does not fit the slice the driver allocated for it.
Clamping it instead would silently shorten the capture-derived rate
feedback and desynchronize the two streams.

  BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound/usb/line6/playback.c:229)
  Write of size 1024 at addr ffff888100bbd400 by task kworker/1:2/5002
  Workqueue: events line6_startup_work
  Call Trace:
   __asan_memcpy (mm/kasan/shadow.c:106)
   submit_audio_out_urb (sound/usb/line6/playback.c:229)
   line6_submit_audio_out_all_urbs (sound/usb/line6/playback.c:291)
   line6_stream_start (sound/usb/line6/pcm.c:194)
   line6_pcm_acquire (sound/usb/line6/pcm.c:337)
   line6_startup_work (sound/usb/line6/driver.c:728)
   process_one_work (kernel/workqueue.c:3396)
   worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

  The buggy address belongs to the object at ffff888100bbd400
   which belongs to the cache kmalloc-256 of size 256
  The buggy address is located 0 bytes inside of
   allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)

## Affected

- `Linux >= 7a0f55aeeb8f1fa32a119d34ddfefc6100936692 < a84371be89c39ccc46c7af8b9eb15c448df9265f`
- `Linux >= 7a0f55aeeb8f1fa32a119d34ddfefc6100936692 < 3f75da1e4ee699f6650d23d6897cf443b01856c7`
- `Linux >= 7a0f55aeeb8f1fa32a119d34ddfefc6100936692 < b78748424f29f07d310484b2b36afdececa74389`
- `Linux >= 7a0f55aeeb8f1fa32a119d34ddfefc6100936692 < 61b0a5a114fa4552892da5c0ff2f42e63bf08c6b`
- `Linux 4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.