LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Prevent excessive number of frames In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer size for each data URB is maxpacksize * packets, which in this example is 40 * 6 = 240; When the user performs a write operation to send audio data into the ALSA PCM playback stream, the calculated number of frames is packsize[0] * packets = 264, which exceeds the allocated URB buffer size, triggering the out-of-bounds (OOB) issue reported by syzbot [1]. Added a check for the number of single data URB frames when calculating the number of frames to prevent [1]. [1] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506 Call Trace: copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611 prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a memory safety bug in USB audio playback handling. A crafted parameter combination can make the kernel copy more audio data than the allocated USB request buffer can hold. The source shows a syzbot/KASAN finding and stable kernel fixes, but no CVSS score or confirmed real-world exploitation.

Executive priority

Track as a kernel patch management item, not an emergency from current evidence. Prioritize internet-facing infrastructure only if it also has relevant local USB audio exposure, and push routine kernel updates through normal change windows.

Technical view

CVE-2026-23208 affects ALSA usb-audio in the Linux kernel. Incorrect frame calculation for playback URBs can exceed the URB buffer size, causing a slab out-of-bounds write in copy_to_urb. The fix adds a frame-count check during frame calculation. Exact downstream distro exposure requires vendor kernel mapping.

Likely exposure

Likely exposure is Linux systems running affected kernel builds with ALSA USB audio support, especially where USB audio playback can be reached. The bundle lists Linux as the affected product but does not provide distro package names, CVSS, or privilege requirements.

Exploitation context

The source describes a syzbot-discovered KASAN slab out-of-bounds write. KEV is false, and the bundle provides no evidence of active exploitation, public weaponization, or exploitation impact beyond the kernel memory safety condition.

Researcher notes

Evidence is limited to the CVE record, Linux stable references, and the syzbot/KASAN trace in the description. The bundle does not establish attacker prerequisites, exploitability, CVSS, or downstream distro fixed package versions.

Mitigation direction

  • Update to a kernel containing the referenced stable fixes.
  • Check Linux distribution advisories for backported kernel package fixes.
  • Prioritize systems using USB audio or exposing untrusted local device interaction.
  • Where patching is delayed, review vendor guidance for USB audio risk reduction.

Validation and detection

  • Inventory kernel versions across Linux assets.
  • Map running kernels to distro advisories and referenced stable commits.
  • Confirm whether ALSA USB audio support is enabled or loaded.
  • Verify patched kernels are deployed and booted, not just installed.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23208 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux02c56650f3c118d3752122996d96173d26bb13aa, 5ef30e443e6d3654cccecec99cf481a69a0a6d3b, 99703c921864a318e3e8aae74fde071b1ff35bea, 2d50acd7dbd0682a56968ad9551341d7fc5b6eaf, aba41867dd66939d336fdf604e4d73b805d8039f, d288dc74f8cf95cb7ae0aaf245b7128627a49bf3, f0bd62b64016508938df9babe47f65c2c727d25c, f0bd62b64016508938df9babe47f65c2c727d25c, 4.4.229, 4.9.229, 4.14.186, 4.19.130, 5.4.49, 5.7.6unaffected
LinuxLinux5.8, 0, 4.4.230, 4.9.230, 4.14.188, 4.19.132, 5.4.51, 5.7.8, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.