CVE-2026-43436: ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
The Scarlett2 mixer quirk in USB-audio driver may hit a NULL dereference when a malformed USB descriptor is passed, since it assumes the presence of an endpoint in the parsed interface in scarlett2findfcinterface(), as reported by fuzzer.
For avoiding the NULL dereference, just add the sanity check of bNumEndpoints and skip the invalid interface.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43436?
The severity of CVE-2026-43436 is medium with a CVSS score of 5.5.
How do I fix CVE-2026-43436?
To fix CVE-2026-43436, you need to apply the available patch to the Linux kernel.
What type of vulnerability is CVE-2026-43436?
CVE-2026-43436 is a Null Pointer Dereference vulnerability affecting the ALSA USB-audio driver.
What components are affected by CVE-2026-43436?
CVE-2026-43436 affects the Linux kernel and the ALSA USB-audio driver.
When was CVE-2026-43436 published?
CVE-2026-43436 was published on May 8, 2026.