CVE-2026-31620: ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0

Q: Who is exposed to this issue?

Systems using the Linux ALSA usx2y driver for the TASCAM US-144MKII are exposed when they can be presented with a malicious USB device claiming that device ID. The affected software list also includes Microsoft azl3 kernel 6.6.130.1-3.

Q: What does an attacker need to exploit it?

An attacker needs to present a malicious USB device using the TASCAM US-144MKII device ID and a configuration that includes interface number 1 but omits interface number 0. No privileges or user interaction are listed in the supplied severity vector.

Q: What is the likely impact of successful exploitation?

The malformed USB configuration can cause a NULL pointer dereference in the driver. The supplied severity vector indicates availability impact only, with no confidentiality or integrity impact.

Published Apr 24, 2026

Updated

ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0

Affected Software

5 affected componentsFixes available

Linux ALSA usx2y driver (Linux kernel, TASCAM US-144MKII)

Linux Linux kernel>=6.18<6.18.24

Linux Linux kernel>=6.19<6.19.14

Linux Linux kernel>=7.0<7.0.1

Microsoft azl3 kernel 6.6.130.1-3

Patch available

Event History

Apr 24, 2026

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

Description

Data Sourced

via NVD·03:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Apr 26, 2026

Data Sourced

via Microsoft·08:02 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using the Linux ALSA usx2y driver for the TASCAM US-144MKII are exposed when they can be presented with a malicious USB device claiming that device ID. The affected software list also includes Microsoft azl3 kernel 6.6.130.1-3.

What does an attacker need to exploit it?

An attacker needs to present a malicious USB device using the TASCAM US-144MKII device ID and a configuration that includes interface number 1 but omits interface number 0. No privileges or user interaction are listed in the supplied severity vector.

What is the likely impact of successful exploitation?

The malformed USB configuration can cause a NULL pointer dereference in the driver. The supplied severity vector indicates availability impact only, with no confidentiality or integrity impact.

CVE-2026-31620: ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?