In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
The Scarlett2 mixer quirk in USB-audio driver may hit a NULL
dereference when a malformed USB descriptor is passed, since it
assumes the presence of an endpoint in the parsed interface in
scarlett2_find_fc_interface(), as reported by fuzzer.
For avoiding the NULL dereference, just add the sanity check of
bNumEndpoints and skip the invalid interface.
References
Configurations
Configuration 1 (hide)
|
History
21 May 2026, 17:43
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-476 | |
| First Time |
Linux linux Kernel
Linux |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/3d4f23885e4b90347c9a1d779af6e79a99b5172a - Patch | |
| References | () https://git.kernel.org/stable/c/3d542cf3c4c854cdf5d58049771f68926b9eb2b9 - Patch | |
| References | () https://git.kernel.org/stable/c/b014cc945baba75816cda0cf8934be87c9ed4947 - Patch | |
| References | () https://git.kernel.org/stable/c/b267255c15d2a5b90c4e926146aa155e5161e264 - Patch | |
| References | () https://git.kernel.org/stable/c/c5c5a6c53cf3b658f1d4512dfa61f3cd25bc34ba - Patch | |
| References | () https://git.kernel.org/stable/c/df1d8abf36ca3681c21a6809eaa9a1e01ef897a6 - Patch |
08 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 15:16
Updated : 2026-05-21 17:43
NVD link : CVE-2026-43436
Mitre link : CVE-2026-43436
CVE.ORG link : CVE-2026-43436
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference