CVE-2026-46018: Linux vulnerability

CVE-2026-46018: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES parse_uac2_sample_rate_range() caps the number of enumerated rates at MAX_NR_RATES, but it only breaks out of the current rate loop. A malformed UAC2 RANGE response with additional triplets continues parsing the remaining triplets and repeatedly prints "invalid uac2 rates" while probe still holds register_mutex. Stop the whole parse once the cap is reached and return the number of rates collected so far.

UnknownCVSS not scoredNot KEV-listedUpdatedOct 15, 2026, 01:19 UTC (UTC+00:00)

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46018 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: May 27, 2026, 12:56 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

1ADP providers

10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
May 13, 2026, 15:03 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
May 27, 2026, 12:56 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Oct 15, 2026, 01:19 UTC (UTC+00:00)

ADP provider summaries

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/5436bc1b07d4656f99412dc72871d250d7d55205CVE reference, Linux
https://git.kernel.org/stable/c/0da05fedf5e1966b7e7d389866cb86fcf09f4b32CVE reference, Linux
https://git.kernel.org/stable/c/f14bd323eec4b4f0ef662520ec852e593ece1d4cCVE reference, Linux
https://git.kernel.org/stable/c/ab5ba9fd138758ddc50222264ff246b31e397abfCVE reference, Linux
https://git.kernel.org/stable/c/ba036305323814ec1f8655313b2fa6a0f7048716CVE reference, Linux
https://git.kernel.org/stable/c/4d7893a137eadb6163ea4298bf67d74b811d76efCVE reference, Linux
https://git.kernel.org/stable/c/a0b78639ef09b2e77974a3de3b1c07f6de3c5e56CVE reference, Linux
https://git.kernel.org/stable/c/3c318f97dcc50b2e0556a1813bd6958678e881fdCVE reference, Linux
https://cert-portal.siemens.com/productcert/html/ssa-784472.htmlCVE reference, siemens-SADP

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux4fa0e81b83503900be277e6273a79651b375e288, 4fa0e81b83503900be277e6273a79651b375e288, 4fa0e81b83503900be277e6273a79651b375e288, 4fa0e81b83503900be277e6273a79651b375e288, 4fa0e81b83503900be277e6273a79651b375e288, 4fa0e81b83503900be277e6273a79651b375e288, 4fa0e81b83503900be277e6273a79651b375e288, 4fa0e81b83503900be277e6273a79651b375e288, 44f059fb742aac78cffdab5e0d8fe0c9910c1ded, c25a53781f61c78bf2a2fa308bbd35b42ba346f6, 3.0.81, 3.2.47unaffected

LinuxLinux3.3, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.