CVE-2026-72403 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: FCP: Fix NULL pointer dereference in interface lookup
A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp_find_fc_interface() currently selects the first vendor-specific interface and reads endpoint 0 from it, without checking whether the interface actually has any endpoints.
When bNumEndpoints is zero, no endpoint array is allocated for the parsed alternate setting, so get_endpoint(..., 0) yields an invalid endpoint descriptor pointer. Dereferencing it through usb_endpoint_num() then triggers a NULL pointer dereference.
Skip vendor-specific interfaces that do not have any endpoints.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability resides within the Linux kernel's Advanced Linux Sound Architecture subsystem, specifically affecting the FCP (Fibre Channel Protocol) interface handling mechanism. The flaw manifests when processing USB devices that present malformed vendor-specific interfaces lacking endpoint descriptors, creating a critical NULL pointer dereference condition that can compromise system stability. The issue stems from inadequate input validation during USB device enumeration and interface parsing operations.
The technical implementation flaw occurs in the fcp_find_fc_interface() function where the kernel attempts to process vendor-specific USB interfaces without proper verification of endpoint existence. When a USB device presents an interface with bNumEndpoints set to zero, indicating no endpoints are defined, the kernel's USB subsystem allocates no endpoint array for that alternate setting. However, the fcp_find_fc_interface() function proceeds to call get_endpoint(..., 0) on what it believes is a valid interface structure, resulting in a pointer to invalid memory location. Subsequent dereferencing through usb_endpoint_num() triggers immediate system termination due to NULL pointer access violations.
This vulnerability directly maps to CWE-476 which identifies NULL pointer dereference conditions as a critical security weakness. The operational impact extends beyond simple system crashes, potentially enabling denial of service attacks against systems running Linux kernel versions with affected ALSA drivers. Attackers could exploit this by connecting malicious USB devices that craft vendor-specific interfaces with zero endpoints, causing kernel panics and system instability. The vulnerability affects the broader ATT&CK framework category of privilege escalation through kernel exploitation techniques, as it represents a foundational security weakness in device driver handling.
The mitigation strategy requires implementing proper validation checks before accessing endpoint descriptors in USB interface processing. The fix involves modifying the fcp_find_fc_interface() function to verify that interfaces possess valid endpoint arrays before attempting to access endpoint zero. This defensive programming approach aligns with industry best practices for kernel security and prevents exploitation of malformed USB device inputs. System administrators should ensure kernel updates are applied promptly, as this vulnerability represents a critical stability risk in embedded systems and servers processing USB input devices. The solution demonstrates proper input sanitization techniques recommended by the Linux kernel security team and aligns with secure coding guidelines for device driver development to prevent similar NULL pointer dereference conditions in other subsystems.