Executive brief
The Linux kernel's ALSA (Advanced Linux Sound Architecture) Focusrite Control Protocol driver can crash when a malformed USB audio device is connected that provides a vendor-specific interface without endpoint descriptors. This causes a kernel panic (denial of service) and system instability when such a device is plugged in.
Technical details
A NULL pointer dereference vulnerability exists in the ALSA FCP driver's fcp_find_fc_interface() function in sound/usb/fcp.c. The vulnerable code attempts to read endpoint descriptor 0 from a vendor-specific USB interface (class 255) without first verifying that the interface actually has any endpoints allocated (bNumEndpoints > 0). When a malformed USB device provides a vendor-specific interface with zero endpoints, the get_endpoint() call returns an invalid pointer, and subsequent dereferencing via usb_endpoint_num() triggers a NULL pointer dereference. The fix adds a simple bounds check to skip interfaces with fewer than 1 endpoint. No remote or local privilege escalation is possible; the impact is limited to denial of service via kernel panic when the malformed device is attached.
Affected products
- Linux Linux kernel all versions with ALSA FCP driver (from commit 46757a3e7d50 onwards, patched in 2026-06-26)
Timeline
- 2026-08-15: disclosed: CVE-2026-72403 published
- 2026-06-26: patched: Fix applied upstream (commit e1e31e0ec8a609e17fd2e86b77bc00d9cbb24d7c)