CVE-2026-46146: Linux Kernel USB Audio DoS Vulnerability

CVE-2026-46146 Overview

CVE-2026-46146 is a denial-of-service vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) USB audio driver. The flaw resides in the convert_chmap_v3() function within the usb-audio subsystem. The function iterates over USB audio class descriptors using cs_desc->wLength as the increment value but fails to validate that field before use. A malformed USB descriptor supplying a zero or undersized wLength can trigger an endless loop in kernel context.

Critical Impact
A malicious or malformed USB audio device can stall a CPU core in the kernel by triggering an infinite loop in convert_chmap_v3(), resulting in denial of service on the affected host.

Affected Products

Linux kernel ALSA usb-audio driver (sound/usb/)
Stable kernel branches receiving commits 4e0ee23, 6e7247d, be09b47, e0e3dcf, and fa5b19c
Any Linux-based system that enumerates untrusted USB audio devices

Discovery Timeline

2026-05-28 - CVE-2026-46146 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46146

Vulnerability Analysis

The convert_chmap_v3() function parses UAC3 (USB Audio Class 3) channel map descriptors returned by a USB audio device. The function walks an array of class-specific descriptors, advancing its pointer by cs_desc->wLength on each iteration. The driver assumed the device-supplied wLength value was valid and non-zero.

When a malformed device reports wLength = 0 or a value smaller than the descriptor header, the loop never advances past the current descriptor. The loop termination condition is never satisfied, causing the kernel thread to spin indefinitely on a CPU core. This is a kernel-mode infinite loop [CWE-835] reachable through device enumeration, which classifies the issue as a denial of service via resource exhaustion.

Because the parsing occurs during USB device probe, the loop runs in a context that can hold subsystem locks and block further USB enumeration, compounding the impact on the host.

Root Cause

The root cause is missing input validation on attacker-controlled descriptor data. The driver trusted cs_desc->wLength without bounds-checking against the minimum descriptor size or the remaining buffer length. The fix introduces an explicit size check that aborts the loop when wLength would not produce forward progress.

Attack Vector

Exploitation requires the ability to attach a USB device to the target system, either through physical access or via a programmable USB peripheral such as a Facedancer or BadUSB-style device. Remote exploitation is not applicable. Once connected, the malicious device advertises itself as a UAC3 audio device and returns a crafted class-specific descriptor with an invalid wLength. Kernel parsing then enters the endless loop without any user interaction beyond device attachment.

The vulnerability is described in upstream stable kernel commits, including Kernel Commit fa5b19c and Kernel Commit be09b47. No public proof-of-concept exploit code is currently available.

Detection Methods for CVE-2026-46146

Indicators of Compromise

A kernel thread (typically a USB probe worker such as kworker/*+usb_*) consuming 100% of a single CPU core immediately after a USB device is inserted.
Soft lockup or RCU stall messages in dmesg referencing convert_chmap_v3 or snd-usb-audio in the call stack.
USB device enumeration that hangs without completing, blocking subsequent USB hot-plug events.

Detection Strategies

Monitor kernel ring buffer output for soft lockup, watchdog: BUG, or RCU stall warnings referencing the snd_usb_audio module.
Audit USB hot-plug events through udev logs and correlate them with sustained CPU saturation on kernel threads.
Track loaded kernel module versions against the patched commit identifiers to identify unpatched hosts in the fleet.

Monitoring Recommendations

Alert on per-core CPU utilization spikes that follow USB device attachment events on servers, kiosks, and shared workstations.
Forward dmesg and journald kernel facility logs to a central logging tier for retention and correlation.
Inventory hosts running kernel versions predating the fix commits to prioritize patch deployment.

How to Mitigate CVE-2026-46146

Immediate Actions Required

Apply the upstream stable kernel update containing commits 4e0ee23, 6e7247d, be09b47, e0e3dcf, and fa5b19c as soon as your distribution publishes a patched build.
Restrict physical USB access on production servers, kiosks, and any system exposed to untrusted users.
Disable or unload the snd-usb-audio module on hosts that do not require USB audio support using modprobe -r snd_usb_audio and blacklisting the module.

Patch Information

The Linux kernel maintainers resolved this issue by adding an explicit size check on cs_desc->wLength before advancing the loop in convert_chmap_v3(). Patched code aborts iteration when wLength would not produce forward progress, eliminating the endless loop. Stable backports are available in the following commits: Kernel Commit 4e0ee23, Kernel Commit 6e7247d, Kernel Commit be09b47, Kernel Commit e0e3dcf, and Kernel Commit fa5b19c.

Workarounds

Enforce USB device authorization policies using /sys/bus/usb/devices/*/authorized or usbguard to require explicit approval before new devices are enumerated.
Blacklist the snd-usb-audio module on systems with no requirement for USB audio peripherals.
Apply physical port controls or disable unused USB controllers in BIOS/UEFI on high-value hosts.

bash

# Configuration example: block snd-usb-audio and require USB authorization

# 1. Prevent the vulnerable driver from loading
echo 'blacklist snd_usb_audio' | sudo tee /etc/modprobe.d/blacklist-snd-usb-audio.conf
sudo modprobe -r snd_usb_audio

# 2. Require explicit authorization for new USB devices
for host in /sys/bus/usb/devices/usb*/authorized_default; do
    echo 0 | sudo tee "$host"
done

# 3. Verify the running kernel includes the fix commit
uname -r