Executive brief
A vulnerability in the Linux kernel's USB audio driver could allow a specially crafted USB device to cause the system to hang or become unresponsive. This occurs because the system fails to properly check data provided by the device, leading to an infinite loop during processing. An attacker with physical access to a computer could use this to cause a denial-of-service.
Technical details
An infinite loop vulnerability exists in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem, specifically within the 'convert_chmap_v3()' function in 'sound/usb/stream.c'. The function iterates through USB Audio Class 3 (UAC3) cluster segment descriptors using a length value ('wLength') provided by the hardware descriptor to increment the loop pointer. Because the code failed to validate that 'wLength' is greater than zero or sufficient to contain the descriptor header, a malformed descriptor can cause the loop to repeat indefinitely. This can be triggered by a malicious or malfunctioning USB device, leading to a kernel hang (Denial of Service). Patches have been merged into multiple stable kernel branches to enforce proper size checks.
Affected products
- Linux Linux kernel v2.6.11 and later
Timeline
- 2026-04-27: patched: Initial fix authored by Takashi Iwai
- 2026-05-28: disclosed: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/4e0ee232ebe3df04874125d7c7f3e6c25ea5483d
- https://git.kernel.org/stable/c/6e7247d8f5fefeceb0bb9cc80a5388a636b219cd
- https://git.kernel.org/stable/c/be09b47ed8677d76962e3240c145502e2ad9f3c8
- https://git.kernel.org/stable/c/e0e3dcf48189603f3865f1a0b799b3b42baae96d
- https://git.kernel.org/stable/c/fa5b19ce69067874b1413f3c2027563bae8c2cb3