Skip to main content

Linux Kernel CVE-2026-74497

| EUVDEUVD-2026-59690 HIGH
2026-08-15 Linux GHSA-56rg-f4qq-ghhv
Information Disclosure Linux Red Hat Suse
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.8 MEDIUM

Attack requires physical connection of a malicious USB device (AV:P not AV:L); no OS-level privileges needed as the exploit originates from the device hardware layer.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.2 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 11:52 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.4 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Clamp frame size in implicit-feedback mode

snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize.

The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits.

Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue.

AnalysisAI

Missing bounds enforcement in the Linux kernel ALSA USB audio driver's implicit-feedback path allows a physically-connected malicious USB device to inject oversized sync packets that propagate un-clamped into the playback endpoint queue. The un-clamped frame count - potentially exceeding ep->maxframesize - can drive packet transfers beyond hardware frame limits, risking kernel memory corruption with high confidentiality, integrity, and availability impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain physical or USB-passthrough access
Delivery
Connect crafted malicious USB audio device
Exploit
Negotiate implicit-feedback sync mode during USB enumeration
Install
Send oversized sync packet exceeding ep->maxframesize
C2
snd_usb_handle_sync_urb() stores un-clamped frame count
Execute
Out-of-bounds access in kernel playback queue
Impact
Kernel memory corruption enabling privilege escalation or crash
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The snd-usb-audio kernel module must be loaded - it auto-loads on most desktop/workstation Linux installations when any USB audio device is connected, but is typically absent from headless server deployments. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS 8.4 with AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H presents a potential scoring inconsistency: AV:L implies OS-level local access, yet the actual attack vector is physical USB device connection, which typically warrants AV:P. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with physical access to a Linux workstation - or with control over a USB device passed through to a virtual machine - connects a specially programmed USB audio device that advertises implicit-feedback sync capability and sends sync packets containing frame counts exceeding ep->maxframesize. The Linux kernel's snd_usb_handle_sync_urb() processes these packets without clamping, passing oversized frame counts into the playback endpoint queue; depending on kernel heap layout, this can trigger out-of-bounds memory access potentially enabling local privilege escalation or kernel crash. …
Remediation Upgrade to a patched kernel version: 6.6.151 or later for the 6.6.x stable branch, 6.12.103 or later for the 6.12.x stable branch, 7.1.8 or later for the 7.1.x stable branch, or 6.18.44 or later for the 6.18.x stable branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Linux systems and identify those running kernel versions prior to 6.6.151, 6.12.103, 7.1.8, or 6.18.44. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-74497 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy