CVE-2026-74641: Linux Kernel Unbounded mmap Page Mapping in Tascam US-428 Driver

The usx2y driver for Tascam US-428 interfaces lets user space mmap a shared control page through its hwdep device. The fault handler turns the page offset into a kernel address with no bound of any kind, and the mmap handler checks only the mapping length, never the offset.

A local user passes a large offset to mmap and gets a read-write mapping of a kernel page it does not own. An offset that lands in unmapped memory oopses instead. The PCM hwdep handler in the same driver has the same bug. The CVE carries a CVSS score of 7.8. The fix rejects any offset outside the shared region.