CVE-2026-23078

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23078
In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Fix buffer overflow in config retrieval The scarlett2_usb_get_config() function has a logic error in the endianness conversion code that can cause buffer overflows when count > 1. The code checks `if (size == 2)` where `size` is the total buffer size in bytes, then loops `count` times treating each element as u16 (2 bytes). This causes the loop to access `count * 2` bytes when the buffer only has `size` bytes allocated. Fix by checking the element size (config_item->size) instead of the total buffer size. This ensures the endianness conversion matches the actual element type.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/27049f50be9f5ae3a62d272128ce0b381cb26a24 Patch
https://git.kernel.org/stable/c/31a3eba5c265a763260976674a22851e83128f6d Patch
https://git.kernel.org/stable/c/51049f6e3f05d70660e2458ad3bb302a3721b751 Patch
https://git.kernel.org/stable/c/6f5c69f72e50d51be3a8c028ae7eda42c82902cb Patch
https://git.kernel.org/stable/c/91a756d22f0482eac5bedb113c8922f90b254449 Patch
https://git.kernel.org/stable/c/d5e80d1f97ae55bcea1426f551e4419245b41b9c Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

18 Mar 2026, 13:53

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/27049f50be9f5ae3a62d272128ce0b381cb26a24 - () https://git.kernel.org/stable/c/27049f50be9f5ae3a62d272128ce0b381cb26a24 - Patch
References () https://git.kernel.org/stable/c/31a3eba5c265a763260976674a22851e83128f6d - () https://git.kernel.org/stable/c/31a3eba5c265a763260976674a22851e83128f6d - Patch
References () https://git.kernel.org/stable/c/51049f6e3f05d70660e2458ad3bb302a3721b751 - () https://git.kernel.org/stable/c/51049f6e3f05d70660e2458ad3bb302a3721b751 - Patch
References () https://git.kernel.org/stable/c/6f5c69f72e50d51be3a8c028ae7eda42c82902cb - () https://git.kernel.org/stable/c/6f5c69f72e50d51be3a8c028ae7eda42c82902cb - Patch
References () https://git.kernel.org/stable/c/91a756d22f0482eac5bedb113c8922f90b254449 - () https://git.kernel.org/stable/c/91a756d22f0482eac5bedb113c8922f90b254449 - Patch
References () https://git.kernel.org/stable/c/d5e80d1f97ae55bcea1426f551e4419245b41b9c - () https://git.kernel.org/stable/c/d5e80d1f97ae55bcea1426f551e4419245b41b9c - Patch
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: ALSA: scarlett2: Corrección de desbordamiento de búfer en la recuperación de configuración La función scarlett2_usb_get_config() tiene un error lógico en el código de conversión de endianness que puede causar desbordamientos de búfer cuando count > 1. El código comprueba 'if (size == 2)' donde 'size' es el tamaño total del búfer en bytes, luego itera 'count' veces tratando cada elemento como u16 (2 bytes). Esto hace que el bucle acceda a 'count * 2' bytes cuando el búfer solo tiene 'size' bytes asignados. Solución comprobando el tamaño del elemento (config_item->size) en lugar del tamaño total del búfer. Esto asegura que la conversión de endianness coincida con el tipo de elemento real.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
CWE CWE-787

06 Feb 2026, 17:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/51049f6e3f05d70660e2458ad3bb302a3721b751 -
  • () https://git.kernel.org/stable/c/d5e80d1f97ae55bcea1426f551e4419245b41b9c -

04 Feb 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 17:16

Updated : 2026-03-18 13:53

NVD link : CVE-2026-23078

Mitre link : CVE-2026-23078

CVE.ORG link : CVE-2026-23078

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write