CVE-2026-72403 ALSA: FCP: Fix NULL pointer dereference in interface lookup
A malformed USB device can trigger a NULL pointer dereference in the Linux kernel ALSA FCP driver, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-72403?
CVE-2026-72403 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: FCP: Fix NULL pointer dereference in interface lookup
A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp_find_fc_interface() currently selects the first vendor-specific interface and reads endpoint 0 from it, without checking whether the interface actually has any endpoints.
When bNumEndpoints is zero, no endpoint array is allocated for the parsed alternate setting, so get_endpoint(..., 0) yields an invalid endpoint descriptor pointer. Dereferencing it through usb_endpoint_num() then triggers a NULL pointer dereference.
Skip vendor-specific interfaces that do not have any endpoints.
Which versions are affected by CVE-2026-72403?
How do I fix CVE-2026-72403?
Apply the vendor's patch.
Is CVE-2026-72403 being exploited?
There is no known exploitation of CVE-2026-72403 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72403, DEBIAN-CVE-2026-72403, GHSA-fr6v-fcwq-3cgm, UBUNTU-CVE-2026-72403.