Executive brief
The Linux kernel's USB Audio Class (UAC) gadget driver contains a buffer overflow vulnerability in how it parses user-supplied sampling rate lists via configuration attributes. An attacker with local access to the system can write more than the maximum allowed number of rates, causing memory corruption that could lead to privilege escalation or system denial of service.
Technical details
The vulnerability exists in the UAC1 and UAC2 configfs rate-list attribute store functions (f_uac1.c and f_uac2.c) which parse comma-separated sampling rates into fixed-size arrays of UAC_MAX_RATES (10) entries. The parsing code fails to validate that the input list contains at most 10 tokens before writing beyond array bounds using opts->name##s[i++]. A local attacker can exploit this by writing an 11+ entry rate list to the p_srate or c_srate configfs attributes, triggering array-index-out-of-bounds writes and memory corruption. Additionally, the code incorrectly frees an advanced strsep() cursor instead of the original buffer pointer, leaking memory on success and potentially freeing interior pointers on error paths. The fix adds bounds checking to reject tokens after UAC_MAX_RATES entries and preserves the original pointer for proper cleanup.
Affected products
- Linux Linux kernel before fix (version not specified in advisory)
Timeline
- 2026-09-17: disclosed: CVE-2026-93122 published on NVD