5.5

CVE-2026-46146: linux Infinite Loop

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2026-46146DEBIAN-CVE-2026-46146
Published 28-05-2026Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2026-46146 is a medium (CVSS 5.5) Infinite Loop vulnerability in linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.17%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 52 · Related 52
OPENSUSE-SU-2026:10954-1OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23193-1SUSE-SU-2026:23194-1

Timeline

  1. 28-05-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() The convert_chmap_v3() has a loop with its increment size of cs_desc->wLength, but we forgot to validate cs_desc->wLength itself, which may lead to potential endless loop by a malformed descriptor. Add a proper size check to abort the loop for plugging the hole.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

+0.04 pp

From 0.13% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu151 products
  • linux< 5.15.0-186.196 | < 6.8.0-136.136 | All versions (No fix recorded) | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1112.119 | < 6.8.0-1061.64 | All versions (No fix recorded) | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 786571b10b1ae6d90e1242848ce78ee7e1d493c4, < 076d5d13eb9c1ad259a7f246149f6676c62285f9 | ≥ 275e37532e8ebe25e8a4069b2d9f955bfd202a46, < 316aa0b1e3c5600eae5ab876394c1ac70e6db581 | ≥ 47ab3d820cb0a502bd0074f83bb3cf7ab5d79902, < 24a40df79307ca7ca0eec0889361cf6ac146d72a | ≥ 1034719fdefd26caeec0a44a868bb5a412c2c1a5, < e0e3dcf48189603f3865f1a0b799b3b42baae96d | ≥ ae17b3b5e753efc239421d186cd1ff06e5ac296e, < 4e0ee232ebe3df04874125d7c7f3e6c25ea5483d | ≥ ecfd41166b72b67d3bdeb88d224ff445f6163869, < be09b47ed8677d76962e3240c145502e2ad9f3c8 | ≥ ecfd41166b72b67d3bdeb88d224ff445f6163869, < fa5b19ce69067874b1413f3c2027563bae8c2cb3 | ≥ ecfd41166b72b67d3bdeb88d224ff445f6163869, < 6e7247d8f5fefeceb0bb9cc80a5388a636b219cd | 799c06ad4c9c790c265e8b6b94947213f1fb389c | dfdcbcde5c20df878178245d4449feada7d5b201 | 7ef3fd250f84494fb2f7871f357808edaa1fc6ce | ≥ 5.10.241, < 5.10.258 | ≥ 5.15.190, < 5.15.209 | ≥ 6.1.149, < 6.1.175 | ≥ 6.6.103, < 6.6.140 | ≥ 6.12.43, < 6.12.88 | ≥ 5.4.297, < 5.5 | ≥ 6.15.11, < 6.16 | ≥ 6.16.2, < 6.17 | 6.17
  • linux_kernelEOL≥ 5.4.297, < 5.5 | ≥ 5.10.241, < 5.10.258 | ≥ 5.15.190, < 5.15.209 | ≥ 6.1.149, < 6.1.175 | ≥ 6.6.103, < 6.6.140 | ≥ 6.12.43, < 6.12.88 | ≥ 6.15.11, < 6.16 | ≥ 6.16.2, < 6.17 | ≥ 6.17.1, < 6.18.30 | ≥ 6.19, < 7.0.7 | 6.17 | 6.17:rc2 | 6.17:rc3 | 6.17:rc4 | 6.17:rc5 | 6.17:rc6 | 6.17:rc7 | 7.1:rc1
Debian1 product
  • linux< 6.1.176-1 | < 6.12.88-1 | < 7.0.7-1

3 vendors · 154 products

References

52 links
Show all 52 references