CVE-2026-72446 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: qcom: reject stream disable with no active interface
handle_uaudio_stream_req() resolves an interface index with info_idx_from_ifnum(), which returns -EINVAL when no interface matches. The enable branch and the response: cleanup label both guard against a negative index, but the disable branch does not: it forms info = &uadev[pcm_card_num].info[info_idx] and dereferences it.
uadev[].info is a pointer allocated only when a stream is first enabled,
so a negative info_idx on the disable path is unsafe in two ways:
- If the card was never enabled, .info is NULL and &info[-EINVAL] is a
wild pointer; reading info->data_ep_pipe faults (kernel oops).
- If the card was enabled at least once (.info allocated) and the disable names an interface that does not match, &info[-EINVAL] points
before the allocation; info->data_ep_pipe / info->sync_ep_pipe are an out-of-bounds slab read and, when non-zero, an out-of-bounds 4-byte write (both pipe fields are cleared to 0). That is memory corruption, not just a NULL dereference.
The request is reachable from unprivileged local userspace over AF_QIPCRTR. Reject a disable request with no resolved interface, matching the guard the enable path already has.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the Linux kernel's ALSA USB audio subsystem within the qcom driver implementation and represents a critical memory corruption flaw that can be exploited by unprivileged local users. The issue stems from an inconsistent handling of stream disable operations compared to enable operations, creating a pathway for both kernel oops and memory corruption scenarios. The vulnerability specifically affects the handle_uaudio_stream_req() function where interface index resolution occurs through info_idx_from_ifnum() which returns -EINVAL when no matching interface exists, but only the enable and response cleanup branches properly guard against negative indices while the disable branch does not.
The technical flaw manifests in how the disable operation processes the interface index without proper validation. When a stream disable request is processed, the code forms a pointer to info = &uadev[pcm_card_num].info[info_idx] without checking if info_idx is valid, leading to unsafe memory access patterns. This creates two distinct attack vectors depending on the card's initialization state. When the card has never been enabled, the .info pointer remains NULL and the negative index calculation results in a wild pointer dereference that causes immediate kernel oops and system crash. However, when the card was previously enabled at least once, creating valid .info allocation, a negative info_idx leads to out-of-bounds memory access where the code attempts to read from or write to memory locations before the allocated slab, specifically targeting info->data_ep_pipe and info->sync_ep_pipe fields that are then cleared to zero.
The operational impact of this vulnerability is significant as it allows unprivileged local users to trigger kernel memory corruption through the AF_QIPCRTR socket interface, which is part of the Qualcomm IPC (Inter-Processor Communication) subsystem. This represents a privilege escalation vector where local attackers can cause system crashes or potentially achieve arbitrary code execution through carefully crafted disable requests that exploit the out-of-bounds memory access patterns. The vulnerability affects systems running Linux kernels with the qcom USB audio driver enabled, particularly those implementing Qualcomm's IPC communication mechanisms.
The fix implements consistent validation across all stream operation branches by rejecting disable requests when no valid interface is resolved, matching the existing guard pattern already present in enable operations. This approach follows the principle of least privilege and defensive programming practices that prevent invalid memory access patterns. The solution aligns with CWE-129: Improper Validation of Array Index and CWE-476: NULL Pointer Dereference categories from the Common Weakness Enumeration, while also addressing ATT&CK techniques related to privilege escalation through kernel exploitation. Organizations should apply the relevant kernel patches immediately, as this vulnerability represents a critical security risk that can be exploited without elevated privileges to cause system instability or potential code execution in vulnerable kernel configurations.
The vulnerability demonstrates how seemingly minor inconsistencies in input validation can lead to serious security implications in kernel space operations. The fix ensures all code paths maintain consistent behavior for interface index validation, preventing both immediate system crashes and more subtle memory corruption attacks that could be leveraged for privilege escalation or denial of service attacks against systems running affected Linux kernel versions with the qcom USB audio driver enabled.