Executive brief
A vulnerability in the Linux kernel's USB audio driver could allow a specially crafted USB device to cause a system crash or potentially access sensitive memory. This occurs when the system attempts to process MIDI 2.0 data from a malicious device. To exploit this, an attacker would need physical access to plug a malformed device into the computer.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem, specifically within the USB MIDI 2.0 endpoint parser in 'sound/usb/midi2.c'. The parser fails to properly validate the 'bLength' field of USB descriptors against the remaining buffer size during endpoint-extra scans. A physically connected malformed USB device can provide descriptors that cause the parser to read beyond the allocated buffer. This can result in a kernel oops or system instability. Patches have been released for various stable branches including 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.5 to 7.1
Timeline
- 2026-05-07: other: Patch submitted by developer
- 2026-06-24: disclosed: CVE published
- 2026-06-24: patched: Fixes merged into stable branches
References
- https://git.kernel.org/stable/c/17e76b19de1aff5ff4de64d269290bd1b07a01d3
- https://git.kernel.org/stable/c/918be519c7876329e1b6e2ea1c59f0b75e792dca
- https://git.kernel.org/stable/c/a310b4bebda5e4a1b26520c0cc5145ccd6d617e2
- https://git.kernel.org/stable/c/f9c184a83574549a36ea69b755f650e57d164c78
- https://git.kernel.org/stable/c/fafc97bd01e4c737eaeafadfdadb1af4bbfa7307