Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-23078

ALSA: scarlett2: Fix buffer overflow in config retrieval

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Fix buffer overflow in config retrieval The scarlett2_usb_get_config() function has a logic error in the endianness conversion code that can cause buffer overflows when count > 1. The code checks `if (size == 2)` where `size` is the total buffer size in bytes, then loops `count` times treating each element as u16 (2 bytes). This causes the loop to access `count * 2` bytes when the buffer only has `size` bytes allocated. Fix by checking the element size (config_item->size) instead of the total buffer size. This ensures the endianness conversion matches the actual element type.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • ac34df733d2dfe3b553897a1e9e1a44414f09834 to < d5e80d1f97ae55bcea1426f551e4419245b41b9caffected
  • ac34df733d2dfe3b553897a1e9e1a44414f09834 to < 51049f6e3f05d70660e2458ad3bb302a3721b751affected
  • ac34df733d2dfe3b553897a1e9e1a44414f09834 to < 91a756d22f0482eac5bedb113c8922f90b254449affected
  • ac34df733d2dfe3b553897a1e9e1a44414f09834 to < 27049f50be9f5ae3a62d272128ce0b381cb26a24affected
  • ac34df733d2dfe3b553897a1e9e1a44414f09834 to < 31a3eba5c265a763260976674a22851e83128f6daffected
  • ac34df733d2dfe3b553897a1e9e1a44414f09834 to < 6f5c69f72e50d51be3a8c028ae7eda42c82902cbaffected

Linux Linux

Default version status: affected

  • 5.14affected
  • 0 to < 5.14unaffected
  • 5.15.199 to ≤ 5.15.*unaffected
  • 6.1.162 to ≤ 6.1.*unaffected
  • 6.6.122 to ≤ 6.6.*unaffected
  • 6.12.68 to ≤ 6.12.*unaffected
  • 6.18.8 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References