CVE-2026-72443

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) USB audio driver. During the handling of MIDI 2.0 input Universal Serial Bus (USB) Request Blocks (URBs), a setup failure can lead to a use-after-free vulnerability. This allows a local attacker, or a malicious USB device, to cause a system crash, resulting in a denial of service. In some scenarios, this flaw could potentially be exploited to achieve arbitrary code execution.

This vulnerability is rated as Moderate because successful exploitation requires physical access or virtualized USB pass-through to connect a crafted USB device, alongside specific device initialization failures. In standard enterprise server environments, USB audio hardware is rarely present, and unprivileged users typically lack the ability to attach arbitrary physical devices. Consequently, the primary operational risk is limited to local denial of service via system crashes on workstations or virtualization hosts with exposed USB redirection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.