---
id: CVE-2026-43436
title: 'ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces

  The Scarlett2 mixer quirk in USB-audio driver may hit a NULL
  dereference when a malformed…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6c0a2078134aba6a77291554035304df9e16b85c <
    b014cc945baba75816cda0cf8934be87c9ed4947
  - >-
    Linux >= 6c0a2078134aba6a77291554035304df9e16b85c <
    c5c5a6c53cf3b658f1d4512dfa61f3cd25bc34ba
  - >-
    Linux >= 6c0a2078134aba6a77291554035304df9e16b85c <
    b267255c15d2a5b90c4e926146aa155e5161e264
  - >-
    Linux >= 6c0a2078134aba6a77291554035304df9e16b85c <
    3d542cf3c4c854cdf5d58049771f68926b9eb2b9
  - >-
    Linux >= 6c0a2078134aba6a77291554035304df9e16b85c <
    3d4f23885e4b90347c9a1d779af6e79a99b5172a
  - >-
    Linux >= 6c0a2078134aba6a77291554035304df9e16b85c <
    df1d8abf36ca3681c21a6809eaa9a1e01ef897a6
  - Linux 5.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:38:31.604468Z'
published: '2026-05-08'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:53.865Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43436'
references:
  - url: 'https://git.kernel.org/stable/c/b014cc945baba75816cda0cf8934be87c9ed4947'
  - url: 'https://git.kernel.org/stable/c/c5c5a6c53cf3b658f1d4512dfa61f3cd25bc34ba'
  - url: 'https://git.kernel.org/stable/c/b267255c15d2a5b90c4e926146aa155e5161e264'
  - url: 'https://git.kernel.org/stable/c/3d542cf3c4c854cdf5d58049771f68926b9eb2b9'
  - url: 'https://git.kernel.org/stable/c/3d4f23885e4b90347c9a1d779af6e79a99b5172a'
  - url: 'https://git.kernel.org/stable/c/df1d8abf36ca3681c21a6809eaa9a1e01ef897a6'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.0205
ingestedAt: '2026-11-06T15:54:03.911Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces

The Scarlett2 mixer quirk in USB-audio driver may hit a NULL
dereference when a malformed USB descriptor is passed, since it
assumes the presence of an endpoint in the parsed interface in
scarlett2_find_fc_interface(), as reported by fuzzer.

For avoiding the NULL dereference, just add the sanity check of
bNumEndpoints and skip the invalid interface.

## Affected

- `Linux >= 6c0a2078134aba6a77291554035304df9e16b85c < b014cc945baba75816cda0cf8934be87c9ed4947`
- `Linux >= 6c0a2078134aba6a77291554035304df9e16b85c < c5c5a6c53cf3b658f1d4512dfa61f3cd25bc34ba`
- `Linux >= 6c0a2078134aba6a77291554035304df9e16b85c < b267255c15d2a5b90c4e926146aa155e5161e264`
- `Linux >= 6c0a2078134aba6a77291554035304df9e16b85c < 3d542cf3c4c854cdf5d58049771f68926b9eb2b9`
- `Linux >= 6c0a2078134aba6a77291554035304df9e16b85c < 3d4f23885e4b90347c9a1d779af6e79a99b5172a`
- `Linux >= 6c0a2078134aba6a77291554035304df9e16b85c < df1d8abf36ca3681c21a6809eaa9a1e01ef897a6`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.