Answer in brief
CVE-2026-74497 records a Unknown severity vulnerability in ALSA: usb-audio: Clamp frame size in implicit-feedback mode. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <56ac3e7c90f6b45969c3fd07a98fad760ffd6901 || >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <be97fea7451d758881b95af78e900dd0d58a382a || >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <2db4535d6af79276a64449201c5be5feffb31c64 || >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <53f0aa37eb945f3c983f61d12fc35eb33debb8a9 || >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <8d7a30c50c2e58a6839634ed0acde14466d1dc61 | 56ac3e7c90f6b45969c3fd07a98fad760ffd6901, be97fea7451d758881b95af78e900dd0d58a382a, 2db4535d6af79276a64449201c5be5feffb31c64, 53f0aa37eb945f3c983f61d12fc35eb33debb8a9, 8d7a30c50c2e58a6839634ed0acde14466d1dc61 |
| Linux/Linuxgeneric | 3.8 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize. The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits. Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-74497 records a Unknown severity vulnerability in ALSA: usb-audio: Clamp frame size in implicit-feedback mode. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <56ac3e7c90f6b45969c3fd07a98fad760ffd6901 || >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <be97fea7451d758881b95af78e900dd0d58a382a || >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <2db4535d6af79276a64449201c5be5feffb31c64 || >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <53f0aa37eb945f3c983f61d12fc35eb33debb8a9 || >=28acb12014fb0c3e1edfdab1b1e3e266cf651550 <8d7a30c50c2e58a6839634ed0acde14466d1dc61 | 56ac3e7c90f6b45969c3fd07a98fad760ffd6901, be97fea7451d758881b95af78e900dd0d58a382a, 2db4535d6af79276a64449201c5be5feffb31c64, 53f0aa37eb945f3c983f61d12fc35eb33debb8a9, 8d7a30c50c2e58a6839634ed0acde14466d1dc61 |
| Linux/Linuxgeneric | 3.8 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize. The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits. Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue.
Quoted source text, attributed separately from HOL analysis.