{"id":"CVE-2026-93808","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: caiaq: validate EP1 reply lengths\n\nusb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then\nreads command-specific fixed items from the …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: caiaq: validate EP1 reply lengths\n\nusb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then\nreads command-specific fixed items from the …","severity":"medium","vendor":"Linux","product":"Linux","affected":["Linux >= 523f1dce37434a9a6623bf46e7893e2b4b10ac3c < 91acd231f219452fa58285239f83945accad9513","Linux >= 523f1dce37434a9a6623bf46e7893e2b4b10ac3c < 7cc6b3745a0cea697c8d0684b3094f220281a08d","Linux >= 523f1dce37434a9a6623bf46e7893e2b4b10ac3c < add9328c91c195c494cd68a21b19e5e47a20d784","Linux >= 523f1dce37434a9a6623bf46e7893e2b4b10ac3c < 319393151367e6626affedcdd4f7b7b0286f4246","Linux >= 523f1dce37434a9a6623bf46e7893e2b4b10ac3c < af8a172c4f71ac30d625f2966d2389a7fa872819","Linux >= 523f1dce37434a9a6623bf46e7893e2b4b10ac3c < 74f3c639f64fa5da4e1613149798b5089bce2807","Linux >= 523f1dce37434a9a6623bf46e7893e2b4b10ac3c < aba30af07d4fe499b50209801eba9da8a815522f","Linux 2.6.22"],"published":"2026-09-24","updated":"2026-10-03","sourceUpdated":"2026-10-03T11:17:50.603","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93808","references":[{"url":"https://git.kernel.org/stable/c/319393151367e6626affedcdd4f7b7b0286f4246","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74f3c639f64fa5da4e1613149798b5089bce2807","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cc6b3745a0cea697c8d0684b3094f220281a08d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91acd231f219452fa58285239f83945accad9513","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aba30af07d4fe499b50209801eba9da8a815522f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/add9328c91c195c494cd68a21b19e5e47a20d784","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af8a172c4f71ac30d625f2966d2389a7fa872819","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93808.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93808"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2540451"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93808"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93808"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93808.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00173,"epssPercentile":0.06618,"ingestedAt":"2026-09-24T16:47:15.896Z","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-125"],"slug":"CVE-2026-93808","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: caiaq: validate EP1 reply lengths\n\nusb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then\nreads command-specific fixed items from the same URB buffer. Several\npaths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that\nurb->actual_length contains those bytes.\n\nAdd per-command length checks, use a payload length derived from the\nbytes after the command byte for the control-state copy, and reject short\nanalog input payloads before the input helper reads fixed offsets from\nthe EP1 reply.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93808.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224294,"id":"CVE-2026-93808","ts":1792325076239,"field":"cvss","old":null,"new":"5.5"},{"seq":224293,"id":"CVE-2026-93808","ts":1792325076239,"field":"severity","old":"none","new":"medium"}]}