Dashboard / CVE-2026-31620

CVE-2026-31620

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 44/100
Published: 2026-04-24 Modified: 2026-11-11 First seen: 2026-11-06 Status: active

Attack Surface

Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Physical
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: None
A: High

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 A malicious USB device with the TASCAM US-144MKII device id can have a configuration containing bInterfaceNumber=1 but no interface 0. USB configuration descriptors are not required to assign interface numbers sequentially, so usb_ifnum_to_if(dev, 0) returns will NULL, which will then be dereferenced directly. Fix this up by checking the return value properly.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
Linux Linux dee1bcf28a3dd13ddb2e9200407864f73e9c4d63 < 09b145c1f1331c40dc955c0024d636f25417cddb
Linux Linux dee1bcf28a3dd13ddb2e9200407864f73e9c4d63 < fbaf29ce00e7bce683f3faf4f2b326bd0a9e6602
Linux Linux dee1bcf28a3dd13ddb2e9200407864f73e9c4d63 < d04dd67ab10dc978c6c843c6bd6a2a66a9444f51
Linux Linux dee1bcf28a3dd13ddb2e9200407864f73e9c4d63 < 48bd344e1040b9f2eb512be73c13f5db83efc191
Linux Linux 6.18
linux linux_kernel 6.18 – 6.18.24

References & Advisories (4)

Bug Bounty Relevance

44 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

4.6 / 10.0 v3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.20%
Raw Score 0.001960
Percentile 9.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00196
2026-11-12
0.00196
2026-11-10
0.00196
2026-11-09
0.00196
2026-11-08
0.00196
2026-11-07
0.00196
2026-11-06
0.00196

Intelligence Sources

mitre ref →
nvd ref →

External Links