CVE-2026-72446

A flaw was found in the Linux kernel's ALSA USB audio subsystem (qcom). An unprivileged local user can exploit this vulnerability by sending a crafted request over AF_QIPCRTR to disable a stream with no active interface. This can lead to an out-of-bounds write, resulting in memory corruption or a kernel oops. Successful exploitation could allow an attacker to cause a denial of service or potentially escalate privileges.

Red Hat rates this issue as Important because a local unprivileged user can trigger kernel memory corruption that may result in arbitrary code execution or a system crash. While the flaw enables elevated local impact, the affected Qualcomm audio offload component is specialized and typically relevant only to systems equipped with Qualcomm architecture. Consequently, standard enterprise installations that do not utilize Qualcomm hardware or audio routing features remain largely unexposed to this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.