{"id":"CVE-2026-74641","state":"PUBLISHED","title":"ALSA: usx2y: bound the hwdep mmap fault offset","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: bound the hwdep mmap fault offset\n\nsnd_us428ctls_vm_fault() turns the faulting page offset into a kernel\naddress with no bound of any kind:\n\n\toffset = vmf->pgoff << PAGE_SHIFT;\n\tvaddr = (char *)(...)->us428ctls_sharedmem + offset;\n\tpage = virt_to_page(vaddr);\n\tget_page(page);\n\tvmf->page = page;\n\n\treturn 0;\n\nsnd_us428ctls_mmap() checks only the length of the mapping, never the\noffset, and us428ctls_sharedmem is a single page from\nalloc_pages_exact().  For a character device file_mmap_size_max()\nreturns ULONG_MAX, so the mm layer imposes no ceiling either.  Every page\noffset above zero resolves to a struct page outside the object, and the\nhandler installs it into the caller's address space read-write; the vma\nis not marked read-only.\n\nThe caller picks the page frame with a single mmap() argument and gets\nread-write access to a page of kernel memory it does not own; an offset\nthat lands in an unpopulated vmemmap region oopses instead.\n\nA process that can open the hwdep node of an attached US-X2Y reaches\nthis after loading the FPGA image through the same node; no capability\ncheck is involved.\n\nOn 7.2.0-rc5 (arm64), mmap() with a large offset:\n\n  Unable to handle kernel paging request at virtual address fffffdffc45d5ac8\n  pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]\n  Call trace:\n   snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]\n   __do_fault\n   __handle_mm_fault\n   handle_mm_fault\n   el0_da\n\nReject any offset outside the shared region.  The pcm hwdep handler in\nusx2yhwdeppcm.c computes its address the same way and needs the same\nbound.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>","publishedAt":"2026-08-22T15:32:19.696Z","updatedAt":"2026-10-16T19:06:04.565Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"ad6fedea65c6e90eda00d716c8bf20cdc437ed10","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"10a87401fb3148c388e55df0148295b3b137da07","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"34ab56ed854baa73a731cfd99af689f0b1bac444","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"4208db2453e1ea71b8048a5b7802360cb29a53f1","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"f613b4a2d87247b51a1b2b330f2e083a454125f2","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"f75d6f61f0d9c5c1ea725104014e10d26d1e3a00","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"5bf5ccddf00b59f1e3ea7e65d76a5f5b5c21cc2e","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"2ca1eea3cd17930daffe9e429a7c89232036ec24","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/usx2y/usX2Yhwdep.c","sound/usb/usx2y/usx2yhwdeppcm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.10.266","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.152","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.104","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/usx2y/usX2Yhwdep.c","sound/usb/usx2y/usx2yhwdeppcm.c"]}],"references":["https://git.kernel.org/stable/c/ad6fedea65c6e90eda00d716c8bf20cdc437ed10","https://git.kernel.org/stable/c/10a87401fb3148c388e55df0148295b3b137da07","https://git.kernel.org/stable/c/34ab56ed854baa73a731cfd99af689f0b1bac444","https://git.kernel.org/stable/c/4208db2453e1ea71b8048a5b7802360cb29a53f1","https://git.kernel.org/stable/c/f613b4a2d87247b51a1b2b330f2e083a454125f2","https://git.kernel.org/stable/c/f75d6f61f0d9c5c1ea725104014e10d26d1e3a00","https://git.kernel.org/stable/c/5bf5ccddf00b59f1e3ea7e65d76a5f5b5c21cc2e","https://git.kernel.org/stable/c/2ca1eea3cd17930daffe9e429a7c89232036ec24"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74641.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74641","state":"PUBLISHED","datePublished":"2026-08-22T15:32:19.696Z","dateUpdated":"2026-10-16T19:06:04.565Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.922Z"},"containers":{"cna":{"title":"ALSA: usx2y: bound the hwdep mmap fault offset","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: bound the hwdep mmap fault offset\n\nsnd_us428ctls_vm_fault() turns the faulting page offset into a kernel\naddress with no bound of any kind:\n\n\toffset = vmf->pgoff << PAGE_SHIFT;\n\tvaddr = (char *)(...)->us428ctls_sharedmem + offset;\n\tpage = virt_to_page(vaddr);\n\tget_page(page);\n\tvmf->page = page;\n\n\treturn 0;\n\nsnd_us428ctls_mmap() checks only the length of the mapping, never the\noffset, and us428ctls_sharedmem is a single page from\nalloc_pages_exact().  For a character device file_mmap_size_max()\nreturns ULONG_MAX, so the mm layer imposes no ceiling either.  Every page\noffset above zero resolves to a struct page outside the object, and the\nhandler installs it into the caller's address space read-write; the vma\nis not marked read-only.\n\nThe caller picks the page frame with a single mmap() argument and gets\nread-write access to a page of kernel memory it does not own; an offset\nthat lands in an unpopulated vmemmap region oopses instead.\n\nA process that can open the hwdep node of an attached US-X2Y reaches\nthis after loading the FPGA image through the same node; no capability\ncheck is involved.\n\nOn 7.2.0-rc5 (arm64), mmap() with a large offset:\n\n  Unable to handle kernel paging request at virtual address fffffdffc45d5ac8\n  pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]\n  Call trace:\n   snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]\n   __do_fault\n   __handle_mm_fault\n   handle_mm_fault\n   el0_da\n\nReject any offset outside the shared region.  The pcm hwdep handler in\nusx2yhwdeppcm.c computes its address the same way and needs the same\nbound.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"ad6fedea65c6e90eda00d716c8bf20cdc437ed10","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"10a87401fb3148c388e55df0148295b3b137da07","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"34ab56ed854baa73a731cfd99af689f0b1bac444","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"4208db2453e1ea71b8048a5b7802360cb29a53f1","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"f613b4a2d87247b51a1b2b330f2e083a454125f2","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"f75d6f61f0d9c5c1ea725104014e10d26d1e3a00","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"5bf5ccddf00b59f1e3ea7e65d76a5f5b5c21cc2e","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"2ca1eea3cd17930daffe9e429a7c89232036ec24","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/usx2y/usX2Yhwdep.c","sound/usb/usx2y/usx2yhwdeppcm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.10.266","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.152","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.104","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/usx2y/usX2Yhwdep.c","sound/usb/usx2y/usx2yhwdeppcm.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ad6fedea65c6e90eda00d716c8bf20cdc437ed10"},{"url":"https://git.kernel.org/stable/c/10a87401fb3148c388e55df0148295b3b137da07"},{"url":"https://git.kernel.org/stable/c/34ab56ed854baa73a731cfd99af689f0b1bac444"},{"url":"https://git.kernel.org/stable/c/4208db2453e1ea71b8048a5b7802360cb29a53f1"},{"url":"https://git.kernel.org/stable/c/f613b4a2d87247b51a1b2b330f2e083a454125f2"},{"url":"https://git.kernel.org/stable/c/f75d6f61f0d9c5c1ea725104014e10d26d1e3a00"},{"url":"https://git.kernel.org/stable/c/5bf5ccddf00b59f1e3ea7e65d76a5f5b5c21cc2e"},{"url":"https://git.kernel.org/stable/c/2ca1eea3cd17930daffe9e429a7c89232036ec24"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local mmap() on the ALSA hwdep character device (/dev/snd/hwC*D*); the path is open→SNDRV_HWDEP_IOCTL_DSP_LOAD→mmap→snd_us428ctls_vm_fault, with no network or remote packet handler involved.\nAC:L - The attacker fully controls the mmap() page offset (vmf->pgoff); any offset beyond the single-page shared buffer deterministically maps an attacker-chosen kernel page read-write or oopses, with no race or uncontrollable memory-layout dependency.\nPR:L - The driver performs no capability checks on hwdep open, ioctl, or mmap; any unprivileged local user who can access the hwdep node (typically via the audio group on desktop distros) can reach the fault handler after loading the FPGA image.\nUI:N - All exploitation steps—opening the hwdep node, loading FPGA firmware via DSP_LOAD ioctl, and mmap with a crafted offset—are performed by the attacker; no discretionary victim action beyond the device being present in the environment is required.\nS:U - Impact is arbitrary read/write of host kernel memory leading to local privilege escalation within the same kernel security authority; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Unbounded pgoff arithmetic maps arbitrary kernel struct pages into the attacker's address space; the VMA is not read-only, giving attacker-controlled read access to any reachable kernel page selected via the mmap offset.\nI:H - The same unbounded mmap fault path installs attacker-chosen kernel pages into a read-write userspace mapping, enabling arbitrary kernel memory writes and heap corruption primitives suitable for privilege escalation or code execution.\nA:H - Large mmap offsets dereference unpopulated vmemmap regions causing kernel paging faults and oops (demonstrated on arm64); arbitrary kernel page writes can also panic the system or destabilize the kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-25T05:41:03.118Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.266"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.152"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.104"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74641","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:03:36.280661Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:06:04.565Z"}}]}}}