CVE-2026-23318: linux Out-of-bounds Read
Vulnerability summary
CVE-2026-23318 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 31 · Related 29Timeline
- 25-03-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
0.00 pp
From 0.13% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu153 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 57f8770620e9b51c61089751f0b5ad3dbe376ff2, < 82a7d0a1b88798de1a609130080ce0c65dd869e9 | ≥ 57f8770620e9b51c61089751f0b5ad3dbe376ff2, < 8307d93e63d5f54ef10412d4db2dd551e920dee4 | ≥ 57f8770620e9b51c61089751f0b5ad3dbe376ff2, < 0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f | ≥ 57f8770620e9b51c61089751f0b5ad3dbe376ff2, < a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7cc | ≥ 57f8770620e9b51c61089751f0b5ad3dbe376ff2, < d3904ca40515272681ae61ad6f561c24f190957f | ≥ 57f8770620e9b51c61089751f0b5ad3dbe376ff2, < 1e5753ff4c2e86aa88516f97a224c90a3d0b133e | ≥ 57f8770620e9b51c61089751f0b5ad3dbe376ff2, < 499ffd15b00dc91ac95c28f76959dfb5cdcc84d5 | ≥ 57f8770620e9b51c61089751f0b5ad3dbe376ff2, < 54f9d645a5453d0bfece0c465d34aaf072ea99fa | 17821e2fb16752f5d363fb5c3f8aab4df41b9bcc | bf74a46aebb1b5ab5e5f25bafa4ae0a453ba813a | ≥ 4.19.84, < 4.20 | ≥ 5.3.11, < 5.4 | 5.4
- linux_kernelEOL≥ 4.19.84, < 4.20 | ≥ 5.3.11, < 5.4 | ≥ 5.4.1, < 5.10.253 | ≥ 5.11, < 5.15.203 | ≥ 5.16, < 6.1.167 | ≥ 6.2, < 6.6.130 | ≥ 6.7, < 6.12.77 | ≥ 6.13, < 6.18.17 | ≥ 6.19, < 6.19.7 | 5.4 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6 | 7.0:rc7
Debian1 product
- linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.8-1
3 vendors · 156 products
