CVE-2026-72446

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72446", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.930Z", "datePublished": "2026-08-15T05:56:56.470Z", "dateUpdated": "2026-08-17T05:44:17.542Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:17.542Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: qcom: reject stream disable with no active interface\n\nhandle_uaudio_stream_req() resolves an interface index with\ninfo_idx_from_ifnum(), which returns -EINVAL when no interface matches.\nThe enable branch and the response: cleanup label both guard against a\nnegative index, but the disable branch does not: it forms\ninfo = &uadev[pcm_card_num].info[info_idx] and dereferences it.\n\nuadev[].info is a pointer allocated only when a stream is first enabled,\nso a negative info_idx on the disable path is unsafe in two ways:\n\n - If the card was never enabled, .info is NULL and &info[-EINVAL] is a\n wild pointer; reading info->data_ep_pipe faults (kernel oops).\n\n - If the card was enabled at least once (.info allocated) and the\n disable names an interface that does not match, &info[-EINVAL] points\n before the allocation; info->data_ep_pipe / info->sync_ep_pipe are an\n out-of-bounds slab read and, when non-zero, an out-of-bounds 4-byte\n write (both pipe fields are cleared to 0). That is memory corruption,\n not just a NULL dereference.\n\nThe request is reachable from unprivileged local userspace over\nAF_QIPCRTR. Reject a disable request with no resolved interface, matching\nthe guard the enable path already has."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires sending a crafted QMI stream-disable request via the AF_QIPCRTR local socket API into the kernel-registered UAUDIO QMI server; it is not reachable over the network or by plugging in USB alone.\nAC:L - An attacker can deterministically trigger the bug by sending enable=0 with a valid usb_token for a probed USB-audio card when no matching interface exists; no race or attacker-uncontrollable memory layout is required.\nPR:L - AF_QIPCRTR permits unprivileged local userspace to deliver QMI requests to the registered service without root or CAP_NET_ADMIN, and the fix commit explicitly states the path is reachable from unprivileged userspace.\nUI:N - Exploitation is a direct programmatic QMI disable request and does not require the victim to mount filesystems, open files, or perform any interactive action at trigger time.\nS:U - The flaw corrupts kernel heap memory within the same kernel security authority; it does not by itself cross a VM, IOMMU, or sandbox boundary to another security domain.\nC:H - When a card was previously enabled, a failed interface lookup yields a negative index that performs an out-of-bounds slab read of endpoint pipe fields before the allocated intf_info array, enabling kernel memory disclosure.\nI:H - The same out-of-bounds path can perform up to two conditional 4-byte writes clearing data_ep_pipe and sync_ep_pipe in adjacent slab memory, constituting exploitable kernel heap corruption rather than a benign crash.\nA:H - If the card was never enabled, info is NULL and indexing with -EINVAL dereferences a wild pointer reading data_ep_pipe, causing a kernel oops/panic and complete local denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/qcom/qc_audio_offload.c"], "versions": [{"version": "326bbc348298ab0946c5560defe024a5f6ef28bb", "lessThan": "25a867aa5e67a84333fa6e5c21292c5bcff86b90", "status": "affected", "versionType": "git"}, {"version": "326bbc348298ab0946c5560defe024a5f6ef28bb", "lessThan": "a22356d1f731553e99aa2707dbd38c659bdd28d8", "status": "affected", "versionType": "git"}, {"version": "326bbc348298ab0946c5560defe024a5f6ef28bb", "lessThan": "bdb640be82e645e2828731648f485224d0c2587b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/qcom/qc_audio_offload.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/25a867aa5e67a84333fa6e5c21292c5bcff86b90"}, {"url": "https://git.kernel.org/stable/c/a22356d1f731553e99aa2707dbd38c659bdd28d8"}, {"url": "https://git.kernel.org/stable/c/bdb640be82e645e2828731648f485224d0c2587b"}], "title": "ALSA: usb-audio: qcom: reject stream disable with no active interface", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/qcom/qc_audio_offload.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "25a867aa5e67a84333fa6e5c21292c5bcff86b90", "status": "affected", "version": "326bbc348298ab0946c5560defe024a5f6ef28bb", "versionType": "git"}, {"lessThan": "a22356d1f731553e99aa2707dbd38c659bdd28d8", "status": "affected", "version": "326bbc348298ab0946c5560defe024a5f6ef28bb", "versionType": "git"}, {"lessThan": "bdb640be82e645e2828731648f485224d0c2587b", "status": "affected", "version": "326bbc348298ab0946c5560defe024a5f6ef28bb", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/qcom/qc_audio_offload.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: qcom: reject stream disable with no active interface\n\nhandle_uaudio_stream_req() resolves an interface index with\ninfo_idx_from_ifnum(), which returns -EINVAL when no interface matches.\nThe enable branch and the response: cleanup label both guard against a\nnegative index, but the disable branch does not: it forms\ninfo = &uadev[pcm_card_num].info[info_idx] and dereferences it.\n\nuadev[].info is a pointer allocated only when a stream is first enabled,\nso a negative info_idx on the disable path is unsafe in two ways:\n\n - If the card was never enabled, .info is NULL and &info[-EINVAL] is a\n wild pointer; reading info->data_ep_pipe faults (kernel oops).\n\n - If the card was enabled at least once (.info allocated) and the\n disable names an interface that does not match, &info[-EINVAL] points\n before the allocation; info->data_ep_pipe / info->sync_ep_pipe are an\n out-of-bounds slab read and, when non-zero, an out-of-bounds 4-byte\n write (both pipe fields are cleared to 0). That is memory corruption,\n not just a NULL dereference.\n\nThe request is reachable from unprivileged local userspace over\nAF_QIPCRTR. Reject a disable request with no resolved interface, matching\nthe guard the enable path already has."}], "id": "CVE-2026-72446", "lastModified": "2026-08-17T06:19:12.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:18.500", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25a867aa5e67a84333fa6e5c21292c5bcff86b90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a22356d1f731553e99aa2707dbd38c659bdd28d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bdb640be82e645e2828731648f485224d0c2587b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: usb-audio: qcom: reject stream disable with no active interface", "id": "2516510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516510"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-124", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: usb-audio: qcom: reject stream disable with no active interface\nhandle_uaudio_stream_req() resolves an interface index with\ninfo_idx_from_ifnum(), which returns -EINVAL when no interface matches.\nThe enable branch and the response: cleanup label both guard against a\nnegative index, but the disable branch does not: it forms\ninfo = &uadev[pcm_card_num].info[info_idx] and dereferences it.\nuadev[].info is a pointer allocated only when a stream is first enabled,\nso a negative info_idx on the disable path is unsafe in two ways:\n- If the card was never enabled, .info is NULL and &info[-EINVAL] is a\nwild pointer; reading info->data_ep_pipe faults (kernel oops).\n- If the card was enabled at least once (.info allocated) and the\ndisable names an interface that does not match, &info[-EINVAL] points\nbefore the allocation; info->data_ep_pipe / info->sync_ep_pipe are an\nout-of-bounds slab read and, when non-zero, an out-of-bounds 4-byte\nwrite (both pipe fields are cleared to 0). That is memory corruption,\nnot just a NULL dereference.\nThe request is reachable from unprivileged local userspace over\nAF_QIPCRTR. Reject a disable request with no resolved interface, matching\nthe guard the enable path already has.", "A flaw was found in the Linux kernel's ALSA USB audio subsystem (qcom). An unprivileged local user can exploit this vulnerability by sending a crafted request over AF_QIPCRTR to disable a stream with no active interface. This can lead to an out-of-bounds write, resulting in memory corruption or a kernel oops. Successful exploitation could allow an attacker to cause a denial of service or potentially escalate privileges."], "name": "CVE-2026-72446", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72446\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72446\nhttps://lore.kernel.org/linux-cve-announce/2026081530-CVE-2026-72446-b0bb@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[326bbc348298ab0946c5560defe024a5f6ef28bb,25a867aa5e67a84333fa6e5c21292c5bcff86b90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[326bbc348298ab0946c5560defe024a5f6ef28bb,a22356d1f731553e99aa2707dbd38c659bdd28d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[326bbc348298ab0946c5560defe024a5f6ef28bb,bdb640be82e645e2828731648f485224d0c2587b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T11:45:03.496146+00:00", "updated": "2026-08-22T05:45:05.252208+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}