CVE-2026-23318: ALSA: usb-audio: Use correct version for UAC3 header validation

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-25 · updated 2026-10-15
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section.

Affected products

Linux kernel: from 4.19.84 before 4.20; from 5.3.11 before 5.4; from 5.4.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130 — fixed in 4.20, 5.10.253, 5.15.203, 5.4, 6.1.167, 6.12.77

How to fix

Upgrade to a fixed version: Linux kernel 4.20, 5.10.253, 5.15.203, 5.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23318 or the next vulnerability affects your stack