SUMMARY
=======
Debian 13 (trixie) linux-image-6.12.115+deb13.1-amd64 / 6.12.115-2
makes USB audio
playback silent on devices using implicit feedback mode. The PCM opens
and reports
RUNNING but zero samples are ever delivered to the device, so no
application can play
audio (and audio-clocked video players stall too).
Capture, non-USB sound cards, and everything not using snd_usb_audio
are unaffected.
AFFECTED HARDWARE / SOFTWARE
============================
- Machine: Lenovo ThinkPad T14 Gen 4, Debian 13 (trixie)
- Kernel: 6.12.115+deb13.1-amd64 (linux-image-amd64 6.12.115-2 from
trixie-security)
- Known-good previous kernel on the same machine: 6.12.113+deb13-amd64
- Device: MOTU M4 USB audio interface, 07fd:000b, UAC2, connected
directly to the
laptop's root hub (usb-0000:64:00.3-1), i.e. no hub in between
- Playback endpoint per /proc/asound/card3/stream0:
Endpoint: 0x02 (2 OUT) (ASYNC)
Data packet interval: 125 us
Sync Endpoint: 0x83 (3 IN)
Sync EP Interface: 2
Sync EP Altset: 1
Implicit Feedback Mode: Yes <-- trigger condition
- Also reported independently for Steinberg UR44 and a Behringer interface, and
described in a public forum thread (Linux Mint/LMDE, 2026-11-03):
https://forums.linuxmint.com/viewtopic.php?t=475920
TIMELINE
========
2026-11-04 14:13 apt-get -y upgrade
2026-11-04 14:14:46 linux-image-6.12.115+deb13.1-amd64 configured
2026-11-04 (all day) working session on 6.12.113 - audio fine
2026-11-05 09:51 first boot on 6.12.115+deb13.1 - audio silent from then on
SYMPTOMS / EVIDENCE
===================
1. PipeWire reports the sink active, unmuted, 100% volume, an uncorked
sink input,
and state RUNNING - yet no sound.
2. Kernel-level PCM position never advances:
$ grep -E 'state|tstamp|avail|hw_ptr|appl_ptr'
/proc/asound/card3/pcm0p/sub0/status
state : RUNNING
tstamp : 0.000000000
delay : 2432
avail : 30336
avail_max : 0
hw_ptr : 0 <-- frozen; ~48000/s expected
appl_ptr : 2432 <-- application keeps writing
(capture on the same device/interface advances normally, e.g.
hw_ptr: 8485528)
3. Reproducible with the entire PipeWire/WirePlumber stack stopped,
using raw aplay:
$ aplay -D hw:3,0 -f S32_LE -r 48000 -c 2 -t raw tone.raw #
blocks forever, hw_ptr stays 0
$ aplay -D hw:3,0 -f S32_LE -r 48000 -c 4 -t raw tone.raw #
write error: Input/output error
Identical for S16_LE/S32_LE, 44100/48000/96000, 2ch/4ch,
hw:/plughw:/sysdefault:.
4. Laptop speakers (snd_hda_intel) play fine on the same kernel.
5. Ruled out: hub/USB topology (reproduced on a direct root-hub port),
PipeWire config,
ALSA config, sample rate/format, device power cycle, second user account.
CAUSE
=====
prepare_playback_urb() in sound/usb/pcm.c gained a per-transfer frame cap:
- offending commit ef5749ef8b307bf8717945701b1b79d036af0a15
"ALSA: usb-audio: Prevent excessive number of frames" (syzbot OOB fix):
- if (counts < 0)
+ if (counts < 0 || frames + counts >= ep->max_urb_frames)
- fix commit 70b4db7d258118a7464f039112a74ddb49a95b06:
+ if (counts < 0 || (frames + counts) * stride > ctx->buffer_size)
ep->max_urb_frames is only assigned for devices that do not use
implicit feedback
(sound/usb/endpoint.c:1254). For implicit-feedback devices it remains
0, so the new
condition "frames + counts >= 0" is true on the very first packet:
every playback URB
is set up with zero packets and no audio is ever submitted.
Mainline picked up the offending commit in stable 6.12.114; the fix
70b4db7d2581 is
not in 6.12.114/6.12.115. 6.12.115-2 is the current trixie-security
candidate, so
Debian 13 users updating now hit silent USB audio playback on implicit-feedback
devices.
A/B CONFIRMATION ON THIS MACHINE (2026-11-05)
=============================================
Same hardware, same userland, same USB port - only the kernel changed:
- 6.12.115+deb13.1-amd64: hw_ptr frozen at 0 with state RUNNING; raw aplay
(PipeWire fully stopped) delivers nothing.
- 6.12.113+deb13-amd64: playback normal; hw_ptr advances at the sample rate.
REQUESTED ACTION
================
1. Backport 70b4db7d2581 into the Debian 6.12.y stable series (and ask
that stable
pick up the pair together, since the offending patch alone breaks
these devices).
2. Alternatively, since it is not in 6.12.116, ensure it lands before the next
trixie-security kernel.
WORKAROUND
==========
Boot 6.12.113+deb13-amd64 (still installed) via GRUB -> Advanced
options for Debian
GNU/Linux. Confirm with a raw-driver probe (aplay -D hw:<card>,0 while sampling
/proc/asound/card<N>/pcm0p/sub0/status): hw_ptr should advance
~48000/s instead of
sitting at 0.