CVE-2026-97930
In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf The in04_last array in struct usx2ydev is declared as char[24], but in04_buf is allocated as sizeof(struct us428_ctls) which is 21 bytes. In i_usx2y_in04_int(), when ctl_snapshot_last == -2 (initialization path): memcpy(usx2y->in04_last, usx2y->in04_buf, sizeof(usx2y->in04_last)); This copies 24 bytes from a 21-byte slab allocation, reading 3 bytes past the end of the source object. Introduce a USX2Y_IN04_SIZE constant defined as sizeof(struct us428_ctls) and use it consistently for the in04_last array, the in04_buf allocation, the URB transfer length, and the comparison loop, replacing the bare 24 and 21 literals throughout.
Affected versions
Linux kernel versions
2.6.12
and later are affected. Fixed in
5.15.222,
6.1.189,
6.6.158,
6.12.111,
6.18.53,
7.2.7,
7.3-rc3
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-97930?
CVE-2026-97930 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.12 onward and has been patched in 5.15.222, 6.1.189, 6.6.158 and others. CVE-2026-97930 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-97930?
Yes. CVE-2026-97930 has been patched. Fixed versions include 5.15.222, 6.1.189, 6.6.158 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-97930 actively exploited?
No. CVE-2026-97930 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.