Linux Kernel NULL Dereference Vulnerability in ALSA USB-Audio Driver for Scarlett2 Mixer

A vulnerability in the Linux kernel's USB-audio driver for Scarlett2 mixers can lead to a NULL pointer dereference. This issue arises when a malformed USB descriptor is received, as the driver expects an endpoint to be present in the parsed interface. The vulnerability has been reported by a fuzzer.

Impact

Exploitation of this vulnerability can cause a NULL pointer dereference, leading to a crash of the affected application or service.

Reproduction

The vulnerability can be reproduced by sending a malformed USB descriptor to a device using the Scarlett2 mixer. This can be done using a USB fuzzer that targets the audio interface.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched.