Skip to main content

Linux Kernel EUVDEUVD-2026-32773

| CVE-2026-46146 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-pvph-jwxq-qcxw
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.6 MEDIUM

Physical USB port access is the fundamental attack prerequisite; once present, no authentication is needed, so AV:P/PR:N; impact is purely availability with no data exposure.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 10, 2026 - 21:31 vuln.today
CVSS changed
Jun 10, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
MEDIUM 5.5
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()

The convert_chmap_v3() has a loop with its increment size of cs_desc->wLength, but we forgot to validate cs_desc->wLength itself, which may lead to potential endless loop by a malformed descriptor.

Add a proper size check to abort the loop for plugging the hole.

AnalysisAI

Denial of service in the Linux kernel ALSA USB audio subsystem allows a local attacker to hang a CPU core indefinitely by presenting a malformed USB audio class v3 channel map descriptor. The affected function convert_chmap_v3() uses the descriptor field cs_desc->wLength as a loop increment without validating it, so a zero-length descriptor causes an unescapable infinite loop that saturates a CPU core until the process is killed or the system rebooted. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, and the EPSS score of 0.02% at the 5th percentile indicates negligible current attacker interest.

Technical ContextAI

The vulnerability exists in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio driver, within the convert_chmap_v3() function in sound/usb/. This function parses USB audio class v3 channel map descriptors received from connected USB audio peripherals. The loop that iterates over descriptor entries uses cs_desc->wLength as its step size, but the kernel failed to validate that field before using it as a loop increment. CWE-835 (Loop with Unreachable Exit Condition) precisely describes the root cause: external, attacker-controlled data from a USB device drives loop progression, and a zero value makes the loop counter never advance, trapping execution. Affected products span multiple Linux kernel stable branches per CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*.

RemediationAI

Apply the vendor-released kernel patch available across multiple stable branches: upgrade to Linux 6.6.140, 6.12.88, 6.18.30, or 7.0.7 as appropriate for your distribution. Fix commits are available at https://git.kernel.org/stable/c/4e0ee232ebe3df04874125d7c7f3e6c25ea5483d, https://git.kernel.org/stable/c/fa5b19ce69067874b1413f3c2027563bae8c2cb3, and sibling commits for other stable branches. As a compensating control where immediate kernel updates are not feasible, unload or blacklist the snd-usb-audio kernel module (modprobe -r snd-usb-audio or adding it to /etc/modprobe.d/blacklist.conf) - note this disables all USB audio devices on the host, which is an acceptable trade-off on servers or kiosks that do not use USB audio. Physical USB port blockers reduce attack surface in high-risk physical access environments. Distribution-specific backported patches may be available from RHEL, Ubuntu, SUSE, and Debian security channels.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-32773 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy