Cloudanix VulnDB

CVE-2026-23318

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux USB audio support lets a specially made USB device read parts of system memory or cause crashes when plugged in.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Incorrect protocol version in the UAC3 AC header validator table entry causes UAC3 descriptors to bypass validation entirely, allowing out-of-bounds reads when the usb-audio driver later dereferences fields from a truncated descriptor supplied by a malicious device.

Why it matters to the business

Systems using USB audio devices on affected kernels risk local memory disclosure or crashes from malicious USB hardware, increasing exposure on endpoints that accept untrusted peripherals and potentially disrupting audio-dependent workflows until kernels are updated.

How an attack unfolds

An attacker presents a USB device that advertises a UAC3 audio control interface containing a deliberately truncated header descriptor; because the validator table still references UAC_VERSION_2, the descriptor passes without checks and the driver performs unsafe field accesses that read beyond the supplied buffer.

How to fix it

Apply the upstream ALSA fix that changes the UAC3 AC header validator table entry from UAC_VERSION_2 to UAC_VERSION_3; rebuild and deploy the corrected kernel, then reboot affected systems.

How to confirm the fix worked

Confirm the validators table in sound/usb/validate.c (or equivalent) now lists UAC_VERSION_3 for the UAC3 header entry; test enumeration of a compliant UAC3 device to ensure validation occurs and no OOB accesses are reported.

Typical attack path

  1. Attach malicious USB device advertising UAC3 audio class interface
  2. Kernel usb-audio driver enumerates the device and locates the AC header descriptor
  3. Validator lookup fails to match due to hardcoded UAC_VERSION_2 entry
  4. Descriptor validation is skipped and subsequent field accesses trigger out-of-bounds reads

How to detect it

Review kernel logs for usb-audio descriptor parsing paths; correlate with unexpected UAC3 device enumerations or oops/panic traces referencing sound/usb; examine audit logs for recent USB device attachments from unknown vendors.

What your security team should do

  • Prioritize kernel updates on all systems that expose USB audio functionality
  • Disable or physically restrict USB ports on high-risk endpoints until patches are applied
  • Add usb-audio module logging to SIEM for anomalous descriptor parsing events

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities