CVE-2026-46184

What it actually does

This vulnerability is a local denial-of-service flaw in the Linux kernel UA-101 USB audio driver. The driver fails to validate the USB audio class descriptor field bNrChannels before using it to calculate frame size. A USB device that reports bNrChannels = 0 can cause frame_bytes to become zero; later, the playback and capture URB completion handlers use that value as a divisor, triggering a divide-by-zero exception in kernel context. The result is a kernel crash or panic, causing loss of system availability. The issue does not directly provide confidentiality or integrity impact, but it can reliably disrupt affected systems when the vulnerable driver probes or processes the malformed USB audio device.

Why it matters to the business

An attacker with local access or the ability to present a malicious USB audio device to a vulnerable Linux system can crash the operating system, interrupting workloads, kiosks, workstations, lab systems, or embedded devices that accept USB peripherals. This is most relevant for environments where untrusted users can connect USB devices, where USB passthrough is enabled, or where systems automatically load kernel drivers for connected hardware. The CVSS score indicates moderate severity, EPSS is currently very low, it is not listed in CISA KEV, and no public exploit maturity is reported, so broad internet-scale exploitation is unlikely; however, physical or local-access denial of service remains practical.

How an attack unfolds

An attacker prepares or emulates a USB audio device whose class-specific audio descriptor advertises zero channels through bNrChannels = 0. The attacker then connects the device to a vulnerable Linux system, or otherwise causes the system to enumerate the device through USB passthrough or a locally controlled USB interface. During driver probing, the UA-101 driver parses the descriptor and, without adequate validation, derives a zero frame size. When playback or capture URB completion handling later occurs, the kernel code divides by that zero value. Because the fault occurs in kernel context, the system records an oops or panic and may crash or require reboot, creating a denial-of-service condition.

How to fix it

Apply a Linux kernel update that includes the UA-101 driver fix adding a sanity check for bNrChannels in detect_usb_format(). Because no exact fixed package versions were provided, use the fixed kernel packages from the relevant Linux distribution or vendor advisory for this CVE, or update to a kernel release containing the upstream sound: ua101 division-by-zero fix. If immediate patching is not possible, reduce exposure by disabling or restricting untrusted USB device attachment, disabling USB passthrough into sensitive systems, applying USB device-control policy, and preventing automatic loading of the affected UA-101 driver where operationally feasible. On systems that do not require this device class, consider blacklisting the affected module or disabling the relevant kernel configuration as a compensating control, after validating that legitimate audio devices and workflows are not impacted.

How to confirm the fix worked

Confirm the running kernel version or vendor package includes the fix for the UA-101 bNrChannels validation issue. Validate that the affected source or backported patch rejects descriptors where bNrChannels is zero before frame-size calculations occur. Operationally, verify that systems are booted into the patched kernel, not merely that the package is installed. Review module-loading policy to ensure unnecessary USB audio drivers are disabled where intended. For exposure checks, identify Linux systems that allow local USB peripherals, USB passthrough, or device emulation and confirm whether the UA-101 driver/module can load. Where safe and authorized, test with a controlled malformed USB descriptor in a non-production lab to verify that the system rejects the device without producing a kernel oops or panic.

Typical attack path

1. Gain local physical access to a Linux system, control a locally attached USB device, or use a context where USB passthrough/device emulation is available.
2. Present a malformed USB audio device descriptor with bNrChannels set to 0 so it is handled by the affected UA-101 driver path.
3. Allow the Linux kernel to enumerate the USB device and load or invoke the vulnerable audio driver.
4. Trigger playback or capture URB completion processing for the malformed device.
5. Cause a kernel divide-by-zero exception, resulting in an oops, panic, crash, or forced reboot.

How to detect it

To determine whether this was already exploited or triggered, review kernel logs, system journals, crash dumps, and hardware inventory events for crashes that occur immediately after USB audio device enumeration. Useful sources include dmesg output, journalctl -k, /var/log/kern.log, /var/log/messages, systemd-coredump metadata where applicable, kdump/vmcore artifacts, and endpoint device-control logs. Look for kernel oops or panic entries showing divide-by-zero faults in playback_urb_complete(), capture_urb_complete(), detect_usb_format(), or the UA-101 USB audio driver path. Correlate crash timestamps with USB insertion events such as new USB device enumeration, audio device registration, snd module loading, or USB passthrough activity. If crash dumps are available, inspect the kernel stack trace for the affected functions and inspect the associated USB descriptor data for bNrChannels equal to zero. Since this is a local/physical or device-emulation attack surface and there is no known public exploitation or KEV listing, absence of internet-facing indicators is expected; focus detection on host telemetry around USB attach events and kernel panics.

• divide error: 0000
• divide error in playback_urb_complete
• divide error in capture_urb_complete
• playback_urb_complete
• capture_urb_complete
• detect_usb_format
• sound/usb/misc/ua101.c
• bNrChannels=0
• bNrChannels = 0
• new USB device found
• USB Audio
• UA-101
• snd-ua101
• snd_usb_ua101
• kernel panic - not syncing
• Oops: divide error

What your security team should do

• Prioritize patching Linux systems where untrusted users can attach USB devices, including shared workstations, kiosks, labs, build systems, and systems with USB passthrough enabled.
• Deploy the latest vendor-supported kernel update that contains the UA-101 descriptor validation fix, and verify systems have rebooted into the fixed kernel.
• Restrict physical USB access and enforce USB device-control policies to block unknown or unauthorized audio devices.
• Disable USB passthrough into virtual machines and sensitive workloads unless explicitly required.
• Blacklist or disable the affected UA-101 driver on systems that do not need it, after testing for operational impact.
• Monitor kernel logs and crash dumps for divide-by-zero exceptions involving UA-101 playback or capture URB completion handlers.
• Treat unexplained kernel crashes shortly after USB audio device insertion as potentially suspicious, especially in shared or physically accessible environments.
• Because this issue is not currently in CISA KEV, has no reported ransomware use, and has very low EPSS, prioritize based on local physical-access risk rather than internet exposure.