CVE-2026-23318 — Improper Validation of Specified Type of Input in Linux
Severity
7.7HIGH
No vectorEPSS
0.0%
top 90.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Use correct version for UAC3 header validation
The entry of the validators table for UAC3 AC header descriptor is
defined with the wrong protocol version UAC_VERSION_2, while it should
have been UAC_VERSION_3. This results in the validator never matching
for actual UAC3 devices (protocol == UAC_VERSION_3), causing their
header descriptors to bypass validation entirely. A malicious USB
device presenting a trunc…
Affected Packages5 packages
▶CVEListV5linux/linux57f8770620e9b51c61089751f0b5ad3dbe376ff2 — 0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f+8
🔴Vulnerability Details
3OSV▶
CVE-2026-23318: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the v↗2026-03-25
GHSA▶
GHSA-x63j-v2j2-m8fv: In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Use correct version for UAC3 header validation
The entry of the↗2026-03-25