CVE-2026-74682: Linux Kernel Out-of-Bounds Write in USB Audio Type II Capture

For Type II USB audio formats, snd-usb-audio sizes the inbound transfer buffer one way and lays out the isochronous frames another. The frame layout never consults the buffer size it was given.

On every capture transfer from such a device, the host controller writes device data past the end of the buffer. A local user with a malicious or faulty Type II USB audio device triggers it through normal recording. The CVE carries a CVSS score of 7.8.