Executive brief
A flaw in the Linux kernel's ALSA FCP audio driver allows a local attacker to read uninitialized kernel memory and copy it to user space. By triggering a USB device response that is shorter than expected, the driver copies the uninitialized portion of its buffer to the user, potentially exposing sensitive kernel data such as addresses and code fragments. This could leak information useful for bypassing kernel address space layout randomization (ASLR).
Technical details
The vulnerability is a kernel memory disclosure in the ALSA FCP driver's fcp_ioctl_init() function. The function allocates a buffer with kmalloc() but fails to zero-initialize it before use. When a USB control transfer (step-0) completes with fewer bytes than requested, the driver does not detect the short transfer and copies the entire uninitialized buffer back to user space via copy_to_user(). The root cause is that snd_usb_ctl_msg() does not enforce the full requested size, allowing partial device responses to succeed. An attacker with local access can trigger this by providing a USB device (or QEMU/emulation) that returns a zero-length step-0 response, causing uninitialized kernel heap data to leak to user space. The fix is to zero the buffer before use and require the device to deliver the full expected number of bytes.
Affected products
- Linux Linux kernel prior to fix
Timeline
- 2026-09-11: disclosed