Linux Kernel CVE-2026-93122

Requires local access with the ability to write to the USB gadget ConfigFS UAC1 or UAC2 rate-list attributes (e.g. p_srate/c_srate), which entails configfs being mounted and a USB gadget being configurable - normally root/privileged operations. The trigger is specifically supplying more than UAC_MAX_RATES (10) comma-separated sampling rates in a single attribute write. Limiting factors: no remote vector (AV:L), the affected code is only built/reachable when the UAC1/UAC2 gadget functions are compiled and instantiated, and the effect is bounded adjacent-memory corruption rather than arbitrary write; there is no user-interaction or network path.

The vendor CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) rates this as a local, low-complexity, low-privilege OOB write with full CIA impact, but the vector's C:H/I:H is inconsistent with the described defect: writing an 11th+ comma-separated rate token walks past the fixed UAC_MAX_RATES (10) int array p_srates[]/c_srates[] inside struct f_uac1_opts / f_uac2_opts, a bounded, adjacent-field heap/struct corruption confirmed by UBSAN, not an information-disclosure or arbitrary-code primitive. Reaching the vulnerable store path requires writing to the UAC1/UAC2 configfs rate-list attributes (e.g. .../gadget/functions/uac1.*/p_srate), which in practice requires the ability to mount configfs and configure a USB gadget - an operation restricted to root/privileged users - so PR:L understates the real privilege requirement (closer to PR:H). No EPSS score, no CISA KEV listing, and no public POC are provided; the only 'exploit' is the vendor's own UBSAN reproducer. The CWE is listed as N/A but the behavior is a classic out-of-bounds array write (CWE-787), and the secondary bug (freeing the strsep-advanced cursor instead of the original kstrdup pointer) adds a memory leak / interior-free on some paths. Net: this is a legitimate local memory-safety bug but a low real-world priority - no evidence of exploitation, niche affected feature, and privileged local access needed.

A local user or process already privileged enough to manage USB gadgets via configfs writes a rate list of more than ten comma-separated sampling rates to a UAC1 or UAC2 p_srate/c_srate attribute, causing the parser to write past the end of the fixed 10-entry rate array and corrupt adjacent kernel memory (crashing the kernel under UBSAN or corrupting the opts struct otherwise). No public exploit exists beyond the vendor's UBSAN reproducer; realistic impact is denial of service / memory corruption rather than code execution or data disclosure.