|
Vulnerabilities
< Back

CVE-2026-43436

Updated on 08 May 2026

Severity

5.5 Medium severity

Details

CVSS score
5.5
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces

The Scarlett2 mixer quirk in USB-audio driver may hit a NULL dereference when a malformed USB descriptor is passed, since it assumes the presence of an endpoint in the parsed interface in scarlett2_find_fc_interface(), as reported by fuzzer.

For avoiding the NULL dereference, just add the sanity check of bNumEndpoints and skip the invalid interface.

Details

Affected product:
AlmaLinux 9.2 ESU , TuxCare 9.6 ESU
Affected packages:
kernel @ 5.14.0 (+1 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 9.2 ESU Planned —
AlmaLinux 9.6 ESU Released
9 kernels
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els1
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els2
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els3
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els4
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els5
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els6
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els7
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els1
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els2
Debian 13 Planned —
Ubuntu 24.04 Planned —