CVE-2026-43436

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB-audio driver, specifically within the Scarlett2 mixer quirk. A local attacker could exploit this vulnerability by providing a specially crafted, malformed USB descriptor. This could lead to a NULL dereference in the scarlett2_find_fc_interface() function, resulting in a system crash and a Denial of Service (DoS).

This Moderate flaw in the Linux kernel's ALSA USB-audio driver can lead to a denial of service. A local attacker with physical access to a system could trigger a NULL dereference by connecting a specially crafted USB audio device utilizing the Scarlett2 mixer quirk, causing a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent a local attacker from exploiting this vulnerability, the snd_usb_audio kernel module can be blacklisted. This will prevent the module from loading and mitigate the risk of a denial of service.

1. Create a new file /etc/modprobe.d/blacklist-snd_usb_audio.conf with the following content: blacklist snd_usb_audio
2. Regenerate the initramfs: # dracut -f -v
3. Reboot the system for the changes to take effect.

Warning: Blacklisting this module will disable all USB audio functionality on the system.