Executive brief
A vulnerability in the Linux kernel's USB audio driver could allow a specially crafted USB device to cause a system hang or denial of service. When a malicious device is plugged in, it can provide malformed audio data that causes the system to enter an infinite loop while holding a critical system lock. This prevents other audio operations from functioning and may impact overall system stability.
Technical details
A vulnerability in the ALSA usb-audio component of the Linux kernel exists within the parse_uac2_sample_rate_range() function in sound/usb/format.c. The function intended to cap the number of enumerated rates at MAX_NR_RATES, but used a 'break' statement that only exited the inner rate loop rather than the entire parsing process. A malformed UAC2 RANGE response with excessive triplets causes the kernel to continue parsing and flood system logs while holding the 'register_mutex' lock. This can lead to a kernel hang or resource exhaustion. The issue has been resolved by changing the 'break' to a 'return' to immediately terminate parsing when the limit is reached.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-15: other: Initial patch authored
- 2026-05-27: disclosed: CVE published
- 2026-05-07: patched: Patches merged into various stable branches
References
- https://git.kernel.org/stable/c/3c318f97dcc50b2e0556a1813bd6958678e881fd
- https://git.kernel.org/stable/c/4d7893a137eadb6163ea4298bf67d74b811d76ef
- https://git.kernel.org/stable/c/a0b78639ef09b2e77974a3de3b1c07f6de3c5e56
- https://git.kernel.org/stable/c/ab5ba9fd138758ddc50222264ff246b31e397abf
- https://git.kernel.org/stable/c/ba036305323814ec1f8655313b2fa6a0f7048716