PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46184 Linux CVE debrief

A division-by-zero vulnerability in the Linux kernel's UA-101 USB audio driver could allow a malicious USB device to crash the kernel. The flaw exists in the Edirol UA-101 driver (sound/usb/ua101.c), where a missing validation of the bNrChannels field in USB audio class descriptors leads to a zero divisor in URB completion handlers. An attacker with physical access could connect a crafted USB device reporting zero channels to trigger a kernel panic. The vulnerability was resolved by adding a sanity check in detect_usb_format() to reject invalid bNrChannel values before they propagate to playback_urb_complete() and capture_urb_complete().

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-11
Advisory published
2026-05-28
Advisory updated
2026-06-11

Who should care

Organizations running Linux systems with Edirol UA-101 USB audio interfaces or allowing physical USB device connections; kernel maintainers and distribution security teams tracking stable kernel updates.

Technical summary

The Edirol UA-101 USB audio driver in the Linux kernel fails to validate the bNrChannels field from USB audio class descriptors. When a device reports bNrChannels=0, the driver calculates frame_bytes=0, which is later used as a divisor in playback_urb_complete() and capture_urb_complete(), causing a kernel crash. The vulnerability requires physical access to connect a malicious or malfunctioning USB device. The fix adds a sanity check in detect_usb_format() to reject descriptors with invalid channel counts before they are used in arithmetic operations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your distribution
  • For systems using Edirol UA-101 USB audio interfaces, verify kernel version includes the fix
  • Restrict physical access to USB ports to prevent connection of malicious USB devices
  • Monitor for kernel updates addressing CVE-2026-46184 in distribution security advisories
  • Consider disabling USB autosuspend for audio devices if hotplugging untrusted devices is required

Evidence notes

The CVE description and kernel.org commit references confirm this is a division-by-zero vulnerability in the UA-101 USB audio driver. The fix adds validation for bNrChannels in detect_usb_format() to prevent zero values from reaching URB completion handlers. Five stable kernel commits are referenced, indicating backports to multiple kernel versions. No CVSS score has been assigned yet (status: Awaiting Analysis).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46184 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46184

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46184 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46184

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0ff2b713f406e9ecadb406014d74e7a020ac12b1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/593dd7e6c890d8e4ca21b3e2f796b7cb8e8da983

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6162e8212e88c39492d981b248b5e37002486c66

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d1f73f169c1014463b5060e3f60813e13ddc7b87

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f1862dbf09080254c52175a448290c784dd7d3de

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.