CVE-2026-72445 Linux CVE debrief

Who should care

Linux system administrators and users who utilize the ALSA usb-audio qcom driver should be aware of this vulnerability and take necessary steps to verify and mitigate it. This includes reviewing the service interval validation, monitoring for disable or disconnect events, and ensuring that the fix is applied. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and track its status to ensure that it is properly addressed.

Technical summary

The vulnerability is caused by the subs->opened flag being set before validating the service interval in the ALSA usb-audio qcom driver. If the interval is invalid, the function jumps to the response label without clearing the flag, causing the substream to be stuck at -EBUSY. To fix this issue, the subs->opened flag should be cleared on the enable error path. This can be achieved by adding a line to clear the flag in the error handling code.

Defensive priority

Medium

Recommended defensive actions

• Inventory Linux systems using the ALSA usb-audio qcom driver
• Verify service interval validation in the ALSA usb-audio qcom driver
• Monitor for disable or disconnect events to resolve -EBUSY errors
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability. However, the source detail is thin, and further verification is needed to confirm the affected scope and vendor remediation. Linux system administrators should verify the service interval validation in the ALSA usb-audio qcom driver and monitor for disable or disconnect events to resolve -EBUSY errors. The vulnerability has been resolved in the Linux kernel, but it is essential to ensure that the fix is applied and that the system is properly configured to prevent similar issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.