CVE-2026-72403

Received Received - Intake

NULL Pointer Dereference in Linux Kernel ALSA FCP

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp_find_fc_interface() currently selects the first vendor-specific interface and reads endpoint 0 from it, without checking whether the interface actually has any endpoints. When bNumEndpoints is zero, no endpoint array is allocated for the parsed alternate setting, so get_endpoint(..., 0) yields an invalid endpoint descriptor pointer. Dereferencing it through usb_endpoint_num() then triggers a NULL pointer dereference. Skip vendor-specific interfaces that do not have any endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72403

EUVD

EUVD-2026-59302

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference flaw in the Linux kernel's ALSA FCP module. A malformed USB device can provide a vendor-specific interface without endpoint descriptors. The kernel's fcp_find_fc_interface() function incorrectly assumes such interfaces have endpoints and tries to access endpoint 0, causing a crash when no endpoints exist.

Detection Guidance

This vulnerability is specific to Linux kernel USB device handling and requires kernel-level inspection. Check kernel logs for NULL pointer dereference errors related to ALSA or USB interfaces using 'dmesg | grep -i 'usb\|alsa\|fcp''. Inspect USB devices with 'lsusb -v' to verify endpoint descriptors. Monitor system crashes or kernel panics that may indicate exploitation.

Impact Analysis

This vulnerability could cause system crashes or instability when a malformed USB device is connected. It may lead to denial-of-service conditions, requiring a reboot to restore normal operation. User data could be lost if the crash occurs during critical operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue involving a NULL pointer dereference in USB device handling, which could cause system crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. Avoid connecting untrusted USB devices until patched. If immediate patching is not possible, disable USB audio interfaces via kernel module blacklisting or restrict USB device access through system policies.

Hi! I’m here to help you understand CVE-2026-72403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70