Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-23318 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23318 is a vulnerability in the Linux kernel's ALSA USB-audio driver, specifically affecting validation of UAC3 (USB Audio Class 3) AC header descriptors. The validators table entry for UAC3 uses the incorrect protocol version UAC_VERSION_2 instead of UAC_VERSION_3, causing the validator to fail matching for actual UAC3 devices. This bypasses header descriptor validation entirely, allowing a malicious USB device presenting a truncated UAC3 header to trigger out-of-bounds reads when the driver accesses unvalidated descriptor fields. The issue stems from a copy-paste error during UAC3 section creation from UAC2 code and is classified as CWE-125 (Out-of-bounds Read) with a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).
A local attacker with low privileges can exploit this vulnerability by connecting a malicious USB audio device that presents a malformed UAC3 header descriptor. Physical access to the target system is required to insert the device, after which the driver processes the descriptor without proper validation. Successful exploitation leads to out-of-bounds memory reads, potentially disclosing sensitive kernel memory (high confidentiality impact) or causing denial of service through system crashes (high availability impact), though no integrity impact is possible.
Mitigation requires updating the Linux kernel to versions incorporating the relevant stable patches, available via kernel.org git commits such as 0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f, 1e5753ff4c2e86aa88516f97a224c90a3d0b133e, 499ffd15b00dc91ac95c28f76959dfb5cdcc84d5, 54f9d645a5453d0bfece0c465d34aaf072ea99fa, and 82a7d0a1b88798de1a609130080ce0c65dd869e9. These patches correct the protocol version in the UAC3 validators table entry to UAC_VERSION_3, restoring proper header validation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15267
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it…
more
should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation directly finds out-of-bounds read flaws through static analysis, fuzzing, and dynamic bounds checks.
Secure engineering principles require bounds checking and memory-safe constructs that stop out-of-bounds reads from being introduced.
Process isolation confines the effects of an out-of-bounds read to the compromised process.
Input validation rejects malformed indices or lengths that would otherwise cause reads outside buffer bounds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.
Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.
Routine patching replaces vulnerable code containing out-of-bounds read flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.
Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds-checked reads, eliminating CWE-125.