CVE-2026-46184: sound: ua101: fix division by zero at probe
In the Linux kernel, the following vulnerability has been resolved:
sound: ua101: fix division by zero at probe
Add a missing sanity check for bNrChannels in detectusbformat() to prevent a division by zero in playbackurbcomplete() and captureurbcomplete().
USB core does not validate class-specific descriptor fields such as bNrChannels, so drivers must verify them before use. If a device provides bNrChannels = 0, framebytes becomes zero and is later used as a divisor in the URB completion handlers, leading to a kernel crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the sound/ua101 driver, add a sanity check in detect_usb_format() to reject devices with bNrChannels = 0 before frame_bytes is calculated or used by playback_urb_complete() and capture_urb_complete().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46184?
CVE-2026-46184 has been assigned a risk score of 37.
How do I fix CVE-2026-46184?
To fix CVE-2026-46184, ensure you update to the patched version of the Linux kernel that addresses the division by zero issue.
What components are affected by CVE-2026-46184?
CVE-2026-46184 affects the sound subsystem in the Linux kernel specifically related to the usb/ua101 device.
What kind of vulnerability is CVE-2026-46184?
CVE-2026-46184 is a vulnerability that involves a division by zero error in the probe functionality of the Linux sound subsystem.
What potential impact does CVE-2026-46184 have?
The potential impact of CVE-2026-46184 includes system crashes or instability during audio playback and capture operations.