CVE-2026-23078 (GCVE-0-2026-23078)
Vulnerability from cvelistv5 – Published: 2026-02-04 16:08 – Updated: 2026-02-09 08:38
VLAI?
Title
ALSA: scarlett2: Fix buffer overflow in config retrieval
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: scarlett2: Fix buffer overflow in config retrieval
The scarlett2_usb_get_config() function has a logic error in the
endianness conversion code that can cause buffer overflows when
count > 1.
The code checks `if (size == 2)` where `size` is the total buffer size in
bytes, then loops `count` times treating each element as u16 (2 bytes).
This causes the loop to access `count * 2` bytes when the buffer only
has `size` bytes allocated.
Fix by checking the element size (config_item->size) instead of the
total buffer size. This ensures the endianness conversion matches the
actual element type.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
ac34df733d2dfe3b553897a1e9e1a44414f09834 , < d5e80d1f97ae55bcea1426f551e4419245b41b9c
(git)
Affected: ac34df733d2dfe3b553897a1e9e1a44414f09834 , < 51049f6e3f05d70660e2458ad3bb302a3721b751 (git) Affected: ac34df733d2dfe3b553897a1e9e1a44414f09834 , < 91a756d22f0482eac5bedb113c8922f90b254449 (git) Affected: ac34df733d2dfe3b553897a1e9e1a44414f09834 , < 27049f50be9f5ae3a62d272128ce0b381cb26a24 (git) Affected: ac34df733d2dfe3b553897a1e9e1a44414f09834 , < 31a3eba5c265a763260976674a22851e83128f6d (git) Affected: ac34df733d2dfe3b553897a1e9e1a44414f09834 , < 6f5c69f72e50d51be3a8c028ae7eda42c82902cb (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_scarlett2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d5e80d1f97ae55bcea1426f551e4419245b41b9c",
"status": "affected",
"version": "ac34df733d2dfe3b553897a1e9e1a44414f09834",
"versionType": "git"
},
{
"lessThan": "51049f6e3f05d70660e2458ad3bb302a3721b751",
"status": "affected",
"version": "ac34df733d2dfe3b553897a1e9e1a44414f09834",
"versionType": "git"
},
{
"lessThan": "91a756d22f0482eac5bedb113c8922f90b254449",
"status": "affected",
"version": "ac34df733d2dfe3b553897a1e9e1a44414f09834",
"versionType": "git"
},
{
"lessThan": "27049f50be9f5ae3a62d272128ce0b381cb26a24",
"status": "affected",
"version": "ac34df733d2dfe3b553897a1e9e1a44414f09834",
"versionType": "git"
},
{
"lessThan": "31a3eba5c265a763260976674a22851e83128f6d",
"status": "affected",
"version": "ac34df733d2dfe3b553897a1e9e1a44414f09834",
"versionType": "git"
},
{
"lessThan": "6f5c69f72e50d51be3a8c028ae7eda42c82902cb",
"status": "affected",
"version": "ac34df733d2dfe3b553897a1e9e1a44414f09834",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_scarlett2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.199",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.162",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.122",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.68",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.199",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.162",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.122",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.68",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.8",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: scarlett2: Fix buffer overflow in config retrieval\n\nThe scarlett2_usb_get_config() function has a logic error in the\nendianness conversion code that can cause buffer overflows when\ncount \u003e 1.\n\nThe code checks `if (size == 2)` where `size` is the total buffer size in\nbytes, then loops `count` times treating each element as u16 (2 bytes).\nThis causes the loop to access `count * 2` bytes when the buffer only\nhas `size` bytes allocated.\n\nFix by checking the element size (config_item-\u003esize) instead of the\ntotal buffer size. This ensures the endianness conversion matches the\nactual element type."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-09T08:38:17.910Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d5e80d1f97ae55bcea1426f551e4419245b41b9c"
},
{
"url": "https://git.kernel.org/stable/c/51049f6e3f05d70660e2458ad3bb302a3721b751"
},
{
"url": "https://git.kernel.org/stable/c/91a756d22f0482eac5bedb113c8922f90b254449"
},
{
"url": "https://git.kernel.org/stable/c/27049f50be9f5ae3a62d272128ce0b381cb26a24"
},
{
"url": "https://git.kernel.org/stable/c/31a3eba5c265a763260976674a22851e83128f6d"
},
{
"url": "https://git.kernel.org/stable/c/6f5c69f72e50d51be3a8c028ae7eda42c82902cb"
}
],
"title": "ALSA: scarlett2: Fix buffer overflow in config retrieval",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23078",
"datePublished": "2026-02-04T16:08:03.283Z",
"dateReserved": "2026-01-13T15:37:45.959Z",
"dateUpdated": "2026-02-09T08:38:17.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-23078\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-04T17:16:18.543\",\"lastModified\":\"2026-02-06T17:16:23.610\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: scarlett2: Fix buffer overflow in config retrieval\\n\\nThe scarlett2_usb_get_config() function has a logic error in the\\nendianness conversion code that can cause buffer overflows when\\ncount \u003e 1.\\n\\nThe code checks `if (size == 2)` where `size` is the total buffer size in\\nbytes, then loops `count` times treating each element as u16 (2 bytes).\\nThis causes the loop to access `count * 2` bytes when the buffer only\\nhas `size` bytes allocated.\\n\\nFix by checking the element size (config_item-\u003esize) instead of the\\ntotal buffer size. This ensures the endianness conversion matches the\\nactual element type.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/27049f50be9f5ae3a62d272128ce0b381cb26a24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/31a3eba5c265a763260976674a22851e83128f6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/51049f6e3f05d70660e2458ad3bb302a3721b751\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f5c69f72e50d51be3a8c028ae7eda42c82902cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/91a756d22f0482eac5bedb113c8922f90b254449\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5e80d1f97ae55bcea1426f551e4419245b41b9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…