Executive brief
The Linux kernel's ALSA USB audio driver for Qualcomm devices contains a vulnerability in stream request handling that can crash the system or corrupt kernel memory. An unprivileged user can send a specially crafted request over a local socket to disable a non-existent audio stream, triggering out-of-bounds memory access. This could lead to kernel panics or allow memory manipulation that may be chained with other exploits.
Technical details
The vulnerability is an out-of-bounds array access in the qc_audio_offload.c driver's handle_uaudio_stream_req() function. When handling a stream disable request, the code fails to validate that the resolved interface index is non-negative before using it to index into the info array. A negative index (returned by info_idx_from_ifnum() when no matching interface exists) causes pointer arithmetic that either reads from or writes to memory before the allocated info structure. An unprivileged local user can reach this code path via AF_QIPCRTR socket communication. The vulnerability results in either a NULL dereference kernel oops or memory corruption via out-of-bounds slab read/write operations. The fix adds a bounds check identical to the one already present in the enable path.
Affected products
- Linux Linux kernel Versions containing the Qualcomm ALSA USB audio offload support (introduced by commit 326bbc348298a)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-07-24: patched: Fix merged into Linux stable kernels