From f5b2de1d93ed7f035750f96848a5bb53d13849db Mon Sep 17 00:00:00 2001 From: CIQ Kernel Automation Date: Mon, 11 May 2026 07:27:50 +0000 Subject: [PATCH 1/3] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() jira VULN-34180 cve CVE-2022-48701 commit-author Dongxiang Ke commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Signed-off-by: Dongxiang Ke Link: https://lore.kernel.org/r/20220906024928.10951-1-kdx.glider@gmail.com Signed-off-by: Takashi Iwai (cherry picked from commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf) Signed-off-by: CIQ Kernel Automation --- sound/usb/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/stream.c b/sound/usb/stream.c index 3a9e5777ba601..3548640eb0d48 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -1131,7 +1131,7 @@ static int __snd_usb_parse_audio_interface(struct snd_usb_audio *chip, * Dallas DS4201 workaround: It presents 5 altsettings, but the last * one misses syncpipe, and does not produce any sound. */ - if (chip->usb_id == USB_ID(0x04fa, 0x4201)) + if (chip->usb_id == USB_ID(0x04fa, 0x4201) && num >= 4) num = 4; for (i = 0; i < num; i++) { From b7c4012bfe582a409bb502a45b79cf23d035e0b1 Mon Sep 17 00:00:00 2001 From: CIQ Kernel Automation Date: Mon, 11 May 2026 07:29:30 +0000 Subject: [PATCH 2/3] media: uvcvideo: Fix double free in error path jira VULN-53319 cve CVE-2024-57980 commit-author Laurent Pinchart commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Reviewed by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab (cherry picked from commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac) Signed-off-by: CIQ Kernel Automation --- drivers/media/usb/uvc/uvc_status.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index b7492775e6ae2..63ba99b573f46 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -178,6 +178,7 @@ int uvc_status_init(struct uvc_device *dev) dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); if (dev->int_urb == NULL) { kfree(dev->status); + dev->status = NULL; return -ENOMEM; } From 489fc12b73a87c9b1954d650e120e22a7220ecbe Mon Sep 17 00:00:00 2001 From: CIQ Kernel Automation Date: Mon, 11 May 2026 07:30:04 +0000 Subject: [PATCH 3/3] HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() jira VULN-56014 cve CVE-2025-21928 commit-author Zhang Lixu commit 07583a0010696a17fb0942e0b499a62785c5fc9f The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver") Signed-off-by: Zhang Lixu Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina (cherry picked from commit 07583a0010696a17fb0942e0b499a62785c5fc9f) Signed-off-by: CIQ Kernel Automation --- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c index 3c14ee07fc587..f20509fae0daa 100644 --- a/drivers/hid/intel-ish-hid/ishtp-hid.c +++ b/drivers/hid/intel-ish-hid/ishtp-hid.c @@ -236,12 +236,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, */ void ishtp_hid_remove(struct ishtp_cl_data *client_data) { + void *data; int i; for (i = 0; i < client_data->num_hid_devices; ++i) { if (client_data->hid_sensor_hubs[i]) { - kfree(client_data->hid_sensor_hubs[i]->driver_data); + data = client_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(client_data->hid_sensor_hubs[i]); + kfree(data); client_data->hid_sensor_hubs[i] = NULL; } }