PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46184 Linux CVE debrief

A division-by-zero vulnerability in the Linux kernel's UA-101 USB audio driver could allow a malicious USB device to crash the kernel. The flaw exists in the Edirol UA-101 driver (sound/usb/ua101.c), where a missing validation of the bNrChannels field in USB audio class descriptors leads to a zero divisor in URB completion handlers. An attacker with physical access could connect a crafted USB device reporting zero channels to trigger a kernel panic. The vulnerability was resolved by adding a sanity check in detect_usb_format() to reject invalid bNrChannel values before they propagate to playback_urb_complete() and capture_urb_complete().

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running Linux systems with Edirol UA-101 USB audio interfaces or allowing physical USB device connections; kernel maintainers and distribution security teams tracking stable kernel updates.

Technical summary

The Edirol UA-101 USB audio driver in the Linux kernel fails to validate the bNrChannels field from USB audio class descriptors. When a device reports bNrChannels=0, the driver calculates frame_bytes=0, which is later used as a divisor in playback_urb_complete() and capture_urb_complete(), causing a kernel crash. The vulnerability requires physical access to connect a malicious or malfunctioning USB device. The fix adds a sanity check in detect_usb_format() to reject descriptors with invalid channel counts before they are used in arithmetic operations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your distribution
  • For systems using Edirol UA-101 USB audio interfaces, verify kernel version includes the fix
  • Restrict physical access to USB ports to prevent connection of malicious USB devices
  • Monitor for kernel updates addressing CVE-2026-46184 in distribution security advisories
  • Consider disabling USB autosuspend for audio devices if hotplugging untrusted devices is required

Evidence notes

The CVE description and kernel.org commit references confirm this is a division-by-zero vulnerability in the UA-101 USB audio driver. The fix adds validation for bNrChannels in detect_usb_format() to prevent zero values from reaching URB completion handlers. Five stable kernel commits are referenced, indicating backports to multiple kernel versions. No CVSS score has been assigned yet (status: Awaiting Analysis).

Official resources

2026-05-28