CVE-2026-23078

HIGH EPSS 4.0%
Published Feb 4, 20264mo ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Feb 4, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Fix buffer overflow in config retrieval The scarlett2_usb_get_config() function has a logic error in the endianness conversion code that can cause buffer overflows when count > 1. The code checks `if (size == 2)` where `size` is the total buffer size in bytes, then loops `count` times treating each element as u16 (2 bytes). This causes the loop to access `count * 2` bytes when the buffer only has `size` bytes allocated. Fix by checking the element size (config_item->size) instead of the total buffer size. This ensures the endianness conversion matches the actual element type.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
4.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 11

VendorProductVersionRange
linuxlinux_kernel*≥5.14  –  <5.15.199
linuxlinux_kernel*≥5.16  –  <6.1.162
linuxlinux_kernel*≥6.2  –  <6.6.122
linuxlinux_kernel*≥6.7  –  <6.12.68
linuxlinux_kernel*≥6.13  –  <6.18.8
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any

References 6

  • git.kernel.org https://git.kernel.org/stable/c/27049f50be9f5ae3a62d272128ce0b381cb26a24
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/31a3eba5c265a763260976674a22851e83128f6d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/51049f6e3f05d70660e2458ad3bb302a3721b751
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6f5c69f72e50d51be3a8c028ae7eda42c82902cb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/91a756d22f0482eac5bedb113c8922f90b254449
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d5e80d1f97ae55bcea1426f551e4419245b41b9c
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/27049f50be9f5ae3a62d272128ce0b381cb26a24
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/31a3eba5c265a763260976674a22851e83128f6d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/51049f6e3f05d70660e2458ad3bb302a3721b751
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6f5c69f72e50d51be3a8c028ae7eda42c82902cb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/91a756d22f0482eac5bedb113c8922f90b254449
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d5e80d1f97ae55bcea1426f551e4419245b41b9c
    Patch