CVE-2026-23318
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- EPSS
- 0.13% probability · 3th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/0dcd1ed96c03459cf14706885c9dd3c1fd8bd29fPatch
- https://git.kernel.org/stable/c/1e5753ff4c2e86aa88516f97a224c90a3d0b133ePatch
- https://git.kernel.org/stable/c/499ffd15b00dc91ac95c28f76959dfb5cdcc84d5Patch
- https://git.kernel.org/stable/c/54f9d645a5453d0bfece0c465d34aaf072ea99faPatch
- https://git.kernel.org/stable/c/82a7d0a1b88798de1a609130080ce0c65dd869e9Patch
- https://git.kernel.org/stable/c/8307d93e63d5f54ef10412d4db2dd551e920dee4Patch
- https://git.kernel.org/stable/c/a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7ccPatch
- https://git.kernel.org/stable/c/d3904ca40515272681ae61ad6f561c24f190957fPatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.