Answer in brief
CVE-2026-46018 records a Unknown severity vulnerability in ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 3.3 | Not reported |
| Linux/Linuxgeneric | >=4fa0e81b83503900be277e6273a79651b375e288 <5436bc1b07d4656f99412dc72871d250d7d55205 || >=4fa0e81b83503900be277e6273a79651b375e288 <0da05fedf5e1966b7e7d389866cb86fcf09f4b32 || >=4fa0e81b83503900be277e6273a79651b375e288 <f14bd323eec4b4f0ef662520ec852e593ece1d4c || >=4fa0e81b83503900be277e6273a79651b375e288 <ab5ba9fd138758ddc50222264ff246b31e397abf || >=4fa0e81b83503900be277e6273a79651b375e288 <ba036305323814ec1f8655313b2fa6a0f7048716 || >=4fa0e81b83503900be277e6273a79651b375e288 <4d7893a137eadb6163ea4298bf67d74b811d76ef || >=4fa0e81b83503900be277e6273a79651b375e288 <a0b78639ef09b2e77974a3de3b1c07f6de3c5e56 || >=4fa0e81b83503900be277e6273a79651b375e288 <3c318f97dcc50b2e0556a1813bd6958678e881fd || 44f059fb742aac78cffdab5e0d8fe0c9910c1ded || c25a53781f61c78bf2a2fa308bbd35b42ba346f6 || >=3.0.81 <3.1 || >=3.2.47 <3.3 | 5436bc1b07d4656f99412dc72871d250d7d55205, 0da05fedf5e1966b7e7d389866cb86fcf09f4b32, f14bd323eec4b4f0ef662520ec852e593ece1d4c, ab5ba9fd138758ddc50222264ff246b31e397abf, ba036305323814ec1f8655313b2fa6a0f7048716, 4d7893a137eadb6163ea4298bf67d74b811d76ef, a0b78639ef09b2e77974a3de3b1c07f6de3c5e56, 3c318f97dcc50b2e0556a1813bd6958678e881fd, 3.1, 3.3 |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
May 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES parse_uac2_sample_rate_range() caps the number of enumerated rates at MAX_NR_RATES, but it only breaks out of the current rate loop. A malformed UAC2 RANGE response with additional triplets continues parsing the remaining triplets and repeatedly prints "invalid uac2 rates" while probe still holds register_mutex. Stop the whole parse once the cap is reached and return the number of rates collected so far.
Quoted source text, attributed separately from HOL analysis.