Linux Kernel CVE-2026-72446

The vulnerability resides in the Qualcomm-platform-specific USB audio driver within the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem, at sound/usb/qcom/. The function handle_uaudio_stream_req() processes stream enable and disable requests delivered over AF_QIPCRTR - Qualcomm's IPC Router socket family used for inter-processor communication on Snapdragon SoCs. Interface resolution is performed by info_idx_from_ifnum(), which returns -EINVAL (−22) when no matching USB audio interface is found. The enable branch and the response: cleanup label both validate that this return value is non-negative before indexing into uadev[pcm_card_num].info[]; the disable branch does not. Using a negative value as an array index in C pointer arithmetic produces a pointer arbitrarily before the allocation base. When uadev[].info is NULL (card never enabled), this yields a wild pointer and a kernel oops on the first dereference. When uadev[].info is valid (card previously enabled), it produces a controllably-offset out-of-bounds slab read of data_ep_pipe and sync_ep_pipe, and a 4-byte zero-write to each of those fields - constituting kernel heap corruption. No CWE is formally assigned in the input data, but this maps to CWE-787 (Out-of-Bounds Write) and CWE-125 (Out-of-Bounds Read). Affected product CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.