Linux Kernel CVE-2026-43436

The primary fix is to upgrade to the patched stable kernel versions: 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, or 7.0, with upstream commits available at git.kernel.org (e.g., https://git.kernel.org/stable/c/b014cc945baba75816cda0cf8934be87c9ed4947 for 6.12.x). The fix adds a sanity check on bNumEndpoints before dereferencing endpoint data in scarlett2_find_fc_interface(). If immediate kernel upgrade is not possible, two compensating controls are available: (1) Disable USB device authorization for untrusted ports using the Linux USB authorization framework (echo 0 > /sys/bus/usb/devices/usbX/authorized_default), which prevents unapproved USB devices from being enumerated - trade-off is that legitimate USB audio devices on that bus will also be blocked; (2) Restrict physical USB port access through hardware or policy controls to prevent unauthorized device attachment - effective in server/kiosk environments but impractical for general workstations. Unloading the snd-usb-audio kernel module (modprobe -r snd-usb-audio) is a targeted workaround that fully disables the vulnerable code path, at the cost of losing all USB audio functionality.