Hi, On Thu, Nov 05, 2026 at 08:58:13PM +0000, Wolle Hartz wrote: > Exactly, the problem occurs with Linux Mint Debian Edition 7 when I > run "apt update && apt full-upgrade"" on a fresh install. Kernel > 6.12.115 gets installed, and the audio interface can no longer be > used. I'm currently using the Trixie backports and have a 7.x > kernel.
>From which version did you update, which was the last one in the 6.12.y series which worked? I suspect this is the same as #1152888, but we need those details first. Additionally can you please test with debian/bin/test-patches approach the 6.12.115-2 plus the attached patch on top to verify it fixes the issue as well for you? Regards, Salvatore
From: Takashi Iwai <[email protected]> Date: Wed, 21 Jan 2026 09:20:20 +0100 Subject: ALSA: usb-audio: Use the right limit for PCM OOB check Origin: https://git.kernel.org/linus/70b4db7d258118a7464f039112a74ddb49a95b06 Bug-Debian: https://bugs.debian.org/1152888 The recent fix commit for addressing the OOB access of PCM URB data buffer caused a regression on Behringer UMC2020HD device, resulting in choppy sound. The fix used ep->max_urb_frames for the upper limit check, and this is no right value to be referred. Use the actual buffer size (ctx->buffer_size) as the upper limit instead, which also avoids the regression on the device above. Fixes: ef5749ef8b30 ("ALSA: usb-audio: Prevent excessive number of frames") Link: https://bugzilla.kernel.org/show_bug.cgi?id=220997 Link: https://patch.msgid.link/[email protected] Signed-off-by: Takashi Iwai <[email protected]> [ sashal: Backport differs from upstream only in indentation, since the for loop sits one block shallower in this tree; the changed lines are otherwise identical. ] Signed-off-by: Sasha Levin <[email protected]> --- sound/usb/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 3a4666e3bf277..5aadd1221f725 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -1505,7 +1505,8 @@ static int prepare_playback_urb(struct snd_usb_substream *subs, for (i = 0; i < ctx->packets; i++) { counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, avail); - if (counts < 0 || frames + counts >= ep->max_urb_frames) + if (counts < 0 || + (frames + counts) * stride > ctx->buffer_size) break; /* set up descriptor */ urb->iso_frame_desc[i].offset = frames * stride; -- 2.53.0
