CVE-2026-23318ALSA: usb-audio: Use correct version for UAC3 header validation
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section.
- CVSS
- 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 57f8770620e9b51c61089751f0b5ad3dbe376ff2 before 82a7d0a1b88798de1a609130080ce0c65dd869e9; from 57f8770620e9b51c61089751f0b5ad3dbe376ff2 before 8307d93e63d5f54ef10412d4db2dd551e920dee4; 57f8770620e9b51c61089751f0b5ad3dbe376ff2 builds before 0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f; from 57f8770620e9b51c61089751f0b5ad3dbe376ff2 before a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7cc; from 57f8770620e9b51c61089751f0b5ad3dbe376ff2 before d3904ca40515272681ae61ad6f561c24f190957f; 57f8770620e9b51c61089751f0b5ad3dbe376ff2 builds before 1e5753ff4c2e86aa88516f97a224c90a3d0b133e; from 57f8770620e9b51c61089751f0b5ad3dbe376ff2 before 499ffd15b00dc91ac95c28f76959dfb5cdcc84d5; 57f8770620e9b51c61089751f0b5ad3dbe376ff2 builds before 54f9d645a5453d0bfece0c465d34aaf072ea99fa; and 4 more ranges | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.19.84 before 4.20; from 5.3.11 before 5.4; from 5.4.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; and 9 more ranges | NVD |
References
- https://git.kernel.org/stable/c/82a7d0a1b88798de1a609130080ce0c65dd869e9patch
- https://git.kernel.org/stable/c/8307d93e63d5f54ef10412d4db2dd551e920dee4patch
- https://git.kernel.org/stable/c/0dcd1ed96c03459cf14706885c9dd3c1fd8bd29fpatch
- https://git.kernel.org/stable/c/a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7ccpatch
- https://git.kernel.org/stable/c/d3904ca40515272681ae61ad6f561c24f190957fpatch
- https://git.kernel.org/stable/c/1e5753ff4c2e86aa88516f97a224c90a3d0b133epatch
- https://git.kernel.org/stable/c/499ffd15b00dc91ac95c28f76959dfb5cdcc84d5patch
- https://git.kernel.org/stable/c/54f9d645a5453d0bfece0c465d34aaf072ea99fapatch
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.