---
id: CVE-2026-98769
title: >-
  kernel: usb: gadget: f_uac1_legacy: validate bRequest index in
  generic_{set,get}_cmd (CVE-2026-98769)
summary: >-
  A flaw was found in the Linux kernel's Universal Serial Bus (USB) audio gadget
  driver. A connected USB host can send a specially crafted audio control
  request with an invalid command index, causing an out-of-bounds heap memory
  read and wri…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-787
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= c47d7b09891abb4f8b222317c89c7469bed8db3a <
    da841c1511a6160b8bc6bb7b7c6d4c9fb76fb51e
  - >-
    Linux >= c47d7b09891abb4f8b222317c89c7469bed8db3a <
    36f3f009049bc91e14dc856007932473318d12f8
  - >-
    Linux >= c47d7b09891abb4f8b222317c89c7469bed8db3a <
    8c611876c002d712ae5f246af5188432c708f79d
  - >-
    Linux >= c47d7b09891abb4f8b222317c89c7469bed8db3a <
    697cfe6e53b66cda196d6f8833b0ee97fefd0a8a
  - >-
    Linux >= c47d7b09891abb4f8b222317c89c7469bed8db3a <
    9062d50e75c24dc7911be05c9b1719b3b256af15
  - Linux 2.6.31
published: '2026-10-18'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T06:41:05+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98769.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98769.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98769'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555063'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98769'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98769'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98769.mbox
  - url: 'https://git.kernel.org/stable/c/da841c1511a6160b8bc6bb7b7c6d4c9fb76fb51e'
  - url: 'https://git.kernel.org/stable/c/36f3f009049bc91e14dc856007932473318d12f8'
  - url: 'https://git.kernel.org/stable/c/8c611876c002d712ae5f246af5188432c708f79d'
  - url: 'https://git.kernel.org/stable/c/697cfe6e53b66cda196d6f8833b0ee97fefd0a8a'
  - url: 'https://git.kernel.org/stable/c/9062d50e75c24dc7911be05c9b1719b3b256af15'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00168
epssPercentile: 0.05981
ingestedAt: '2026-10-18T16:47:32.493Z'
---

## Overview

A flaw was found in the Linux kernel's Universal Serial Bus (USB) audio gadget driver. A connected USB host can send a specially crafted audio control request with an invalid command index, causing an out-of-bounds heap memory read and write. This flaw primarily allows an attacker to cause a Denial of Service (DoS) via a system crash, or potentially lead to kernel memory corruption.

## Vendor advisories

- **Red Hat VEX** · Important · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98769.json)

**kernel: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd** — rated Important by Red Hat. Released 2026-10-18, updated 2026-10-23.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.