Executive brief
A vulnerability in the Linux kernel's Edirol UA-101 USB audio driver could allow a system crash when a malicious or faulty USB device is plugged in. The driver fails to verify the number of audio channels reported by the device, which can lead to a mathematical error (division by zero) during initialization. This results in a kernel panic, causing the entire system to stop responding and requiring a reboot.
Technical details
A division-by-zero vulnerability exists in the sound/usb/misc/ua101.c driver of the Linux kernel. The function detect_usb_format() fails to validate the bNrChannels field in the USB class-specific descriptor. If a connected device reports zero channels, the frame_bytes variable is calculated as zero and subsequently used as a divisor in the playback_urb_complete() and capture_urb_complete() handlers. An attacker with physical access could trigger this by connecting a specially crafted USB device, resulting in a Denial of Service (kernel panic). Patches have been released across multiple stable kernel branches to add the necessary sanity checks.
Affected products
- Linux Linux Kernel All versions since 63978ab3e3e9 (sound: add Edirol UA-101 support)
Timeline
- 2026-04-26: other: Vulnerability fixed in upstream source code
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0ff2b713f406e9ecadb406014d74e7a020ac12b1
- https://git.kernel.org/stable/c/593dd7e6c890d8e4ca21b3e2f796b7cb8e8da983
- https://git.kernel.org/stable/c/6162e8212e88c39492d981b248b5e37002486c66
- https://git.kernel.org/stable/c/d1f73f169c1014463b5060e3f60813e13ddc7b87
- https://git.kernel.org/stable/c/f1862dbf09080254c52175a448290c784dd7d3de