CVE-2026-72403

A flaw was found in the ALSA FireWire Control Protocol (FCP) component of the Linux kernel. A local attacker with a specially crafted USB device could trigger a NULL pointer dereference. This occurs because the fcp_find_fc_interface() function attempts to access an endpoint descriptor from a malformed USB device that does not provide any, leading to an invalid pointer dereference. This vulnerability could cause a system crash, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel ALSA Focusrite Control Protocol (FCP) USB driver. The fcp_find_fc_interface() function selects the first vendor-specific USB interface and reads endpoint 0 from it without checking whether that interface declares any endpoints. A physically present attacker able to connect a specially crafted USB device that reports a vendor-specific interface with bNumEndpoints set to zero can cause get_endpoint(..., 0) to yield an invalid endpoint descriptor pointer, which usb_endpoint_num() then dereferences, resulting in a NULL pointer dereference that crashes the kernel and causes a denial of service. No confidentiality or integrity impact is supported. Red Hat rates the impact of this flaw as Low because exploiting it requires physical access to connect a crafted USB device, a lower severity than the CVSS base score alone would suggest. The vulnerable FCP driver code is not present in Red Hat Enterprise Linux 6, 7, and 8, nor in earlier RHEL 9 and RHEL 10 minor streams such as rhel-9.2, rhel-9.4, rhel-9.6, and rhel-10.0, so those products are not affected. For the affected RHEL 9.8, RHEL 9.9, RHEL 10.2, RHEL 10.3, and Red Hat In-Vehicle OS 2 kernel streams, the fix is deferred to a future update; the residual risk is limited to a local denial of service that requires an attacker to have physical access to plug a malformed USB device into the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.