CVE-2026-46184: Linux Kernel ua101 DoS Vulnerability

CVE-2026-46184 Overview

CVE-2026-46184 is a division-by-zero vulnerability in the Linux kernel's ua101 USB audio driver. The flaw resides in the detect_usb_format() function, which fails to validate the class-specific bNrChannels descriptor field received from a USB device. When a malicious or malformed USB device reports bNrChannels = 0, the calculated frame_bytes value becomes zero. This zero value is subsequently used as a divisor in playback_urb_complete() and capture_urb_complete(), triggering a kernel crash.

Critical Impact
A crafted USB audio device can trigger a kernel-level division by zero, causing a denial-of-service condition on the host system.

Affected Products

Linux kernel — sound/usb/misc/ua101.c (UA101 USB audio driver)
Multiple stable kernel branches receiving the backported fix
Systems with the snd-usb-ua101 module loaded or available for hotplug

Discovery Timeline

2026-05-28 - CVE-2026-46184 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46184

Vulnerability Analysis

The Linux ua101 driver supports the Edirol UA-101 and UA-1000 USB audio interfaces. During device probe, detect_usb_format() parses class-specific audio streaming descriptors supplied by the connected USB device. The driver computes frame_bytes based on bNrChannels and sample size, then stores the value for use in URB (USB Request Block) completion paths.

The USB core layer does not validate class-specific descriptor fields. Drivers must therefore sanity-check every value before relying on it. The ua101 driver omitted this validation for bNrChannels, allowing a value of zero to propagate into arithmetic operations in the audio streaming hot path.

When frame_bytes is zero, both playback_urb_complete() and capture_urb_complete() perform a divide operation using the field as a divisor. The resulting divide-by-zero exception triggers a kernel oops, terminating the audio subsystem and potentially destabilizing the host.

Root Cause

The root cause is missing input validation on attacker-controlled descriptor data [CWE-369: Divide By Zero]. The driver trusted that bNrChannels would be a non-zero value because legitimate audio devices always report at least one channel. A malicious or malfunctioning device can supply zero, bypassing implicit assumptions in the code path.

Attack Vector

Exploitation requires physical or logical attachment of a crafted USB device. An attacker plugs a programmable USB device (for example, a Facedancer or BadUSB-class tool) that advertises itself as a UA101-compatible audio device with bNrChannels = 0. When the kernel binds the ua101 driver and audio streaming begins, the URB completion handler divides by zero and the kernel crashes. The result is a local denial of service against unattended workstations, kiosks, and servers exposing USB ports.

No verified public exploit code is available. The vulnerability is described in prose because no sanitized proof-of-concept has been published. The upstream fix adds an explicit check rejecting bNrChannels == 0 in detect_usb_format() before any arithmetic uses the value.

Detection Methods for CVE-2026-46184

Indicators of Compromise

Kernel oops or panic messages referencing playback_urb_complete or capture_urb_complete in dmesg and /var/log/kern.log
Divide error (#DE) exceptions logged immediately after USB device enumeration events involving the snd-usb-ua101 module
Unexpected loading of snd-usb-ua101 on hosts that do not legitimately use Edirol UA-101 hardware

Detection Strategies

Correlate USB device hotplug events from udev with kernel exception traces to flag suspicious audio class descriptors
Parse USB descriptor logs (for example, via usbmon or udevadm monitor) for audio streaming interfaces reporting bNrChannels = 0
Alert on repeated kernel crashes on systems with physical USB exposure, particularly shared workstations and lab equipment

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and create rules for divide_error, Oops, and Kernel panic patterns
Track loaded kernel module changes with auditd rules on init_module and finit_module syscalls
Monitor USB device insertion telemetry on endpoints in high-risk physical environments

How to Mitigate CVE-2026-46184

Immediate Actions Required

Apply the upstream stable kernel update containing the bNrChannels sanity check as soon as your distribution ships it
On systems that do not require USB audio support, blacklist the snd-usb-ua101 module to remove the attack surface
Enforce USB device control policies that block unknown audio-class devices on critical endpoints

Patch Information

The fix is committed across multiple stable branches. Refer to the upstream commits for the exact patch contents:

The patch adds a check rejecting bNrChannels = 0 in detect_usb_format() so frame_bytes can never become zero before reaching the URB completion handlers.

Workarounds

Blacklist the vulnerable module if UA101 hardware is not required: add blacklist snd-usb-ua101 to /etc/modprobe.d/blacklist.conf
Restrict USB device authorization using the kernel usbguard framework or by setting authorized_default = 0 on USB controllers
Physically restrict USB port access on shared and unattended systems through chassis locks or port-blocking hardware

bash

# Prevent the vulnerable driver from loading
echo "blacklist snd-usb-ua101" | sudo tee /etc/modprobe.d/disable-ua101.conf
sudo update-initramfs -u

# Optional: require explicit authorization for new USB devices
for host in /sys/bus/usb/devices/usb*; do
  echo 0 | sudo tee "$host/authorized_default"
done