CVE-2026-46146

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) usb-audio subsystem. This vulnerability exists in the convert_chmap_v3() function, where the cs_desc->wLength value is not properly validated. A malicious actor could provide a specially crafted, malformed USB audio descriptor. This could lead to an endless loop, causing a Denial of Service (DoS) on the affected system.

This vulnerability is rated as Moderate severity because successful exploitation requires attaching a crafted USB peripheral or configuring USB redirection in a virtualized guest, resulting strictly in a local denial of service without compromising confidentiality or integrity. Standard Red Hat Enterprise Linux server deployments typically restrict physical access and disallow arbitrary hardware attachment, significantly limiting real-world exposure. Environments permitting untrusted USB hardware or passthrough remain at risk of kernel stalls.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.