Overview
The snd-usb-audio mixer quirk for RME Digiface USB reads a four-word status block from the device into an uninitialised stack buffer. If the device answers with a short data stage, the trailing words keep whatever was on the kernel stack, and the only check in the caller is for a negative error code.
Those stale words are copied into the status array and exposed through eight ALSA control elements. An unprivileged process reading /dev/snd/controlC* gets the full 16-byte frame of leaked kernel stack. The fix zeroes the buffer before the read.
Affected products
- Linux kernel 6.12 and later before the 15 Aug 2026 stable updates
Disclosure timeline
- 15 Aug 2026
- CVE-2026-74500 published by the Linux kernel CVE team; stable fixes released