CVE-2026-23078None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Fix buffer overflow in config retrieval The scarlett2_usb_get_config() function has a logic error in the endianness conversion code that can cause buf…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
ALSA: scarlett2: Fix buffer overflow in config retrieval
The scarlett2_usb_get_config() function has a logic error in the endianness conversion code that can cause buffer overflows when count > 1.
The code checks if (size == 2) where size is the total buffer size in
bytes, then loops count times treating each element as u16 (2 bytes).
This causes the loop to access count * 2 bytes when the buffer only
has size bytes allocated.
Fix by checking the element size (config_item->size) instead of the total buffer size. This ensures the endianness conversion matches the actual element type.
Linux >= ac34df733d2dfe3b553897a1e9e1a44414f09834 < d5e80d1f97ae55bcea1426f551e4419245b41b9cLinux >= ac34df733d2dfe3b553897a1e9e1a44414f09834 < 51049f6e3f05d70660e2458ad3bb302a3721b751Linux >= ac34df733d2dfe3b553897a1e9e1a44414f09834 < 91a756d22f0482eac5bedb113c8922f90b254449Linux >= ac34df733d2dfe3b553897a1e9e1a44414f09834 < 27049f50be9f5ae3a62d272128ce0b381cb26a24Linux >= ac34df733d2dfe3b553897a1e9e1a44414f09834 < 31a3eba5c265a763260976674a22851e83128f6dLinux >= ac34df733d2dfe3b553897a1e9e1a44414f09834 < 6f5c69f72e50d51be3a8c028ae7eda42c82902cbLinux 5.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses