Executive brief
A vulnerability in the Linux kernel's USB MIDI driver could allow a local user to cause a system crash or leak sensitive information. The issue occurs when a USB MIDI device is configured with an unequal number of input and output ports, leading to the transmission of incorrect data descriptors. This can result in the disclosure of uninitialized memory or system instability.
Technical details
A vulnerability exists in the 'f_midi' component of the Linux kernel's USB gadget framework. The root cause is an incorrect assignment of 'bNumEmbMIDIJack' and 'bLength' in MIDI Streaming endpoint descriptors. When the number of 'in' and 'out' ports are not equal, the driver uses the wrong port count to calculate descriptor sizes. This results in the host receiving malformed descriptors that contain uninitialized stack memory. An attacker with local access could potentially exploit this to leak kernel memory or cause a denial-of-service (system crash). The issue has been patched across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 3.2 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4
Timeline
- 2025-01-30: other: Patch authored
- 2025-03-07: disclosed: CVE published
- 2025-03-13: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/3a983390d14e8498f303fc5cb23ab7d696b815db
- https://git.kernel.org/stable/c/6ae6dee9f005a2f3b739b85abb6f14a0935699e0
- https://git.kernel.org/stable/c/6b16761a928796e4b49e89a0b1ac284155172726
- https://git.kernel.org/stable/c/9f36a89dcb78cb7e37f487b04a16396ac18c0636
- https://git.kernel.org/stable/c/9f6860a9c11301b052225ca8825f8d2b1a5825bf
- https://git.kernel.org/stable/c/a2d0694e1f111379c1efdf439dadd3cfd959fe9d
- https://git.kernel.org/stable/c/d8e86700c8a8cf415e300a0921acd6a8f9b494f8