Executive brief
A vulnerability in the Linux kernel's USB audio MIDI driver allows a malicious or malformed USB audio device to trigger a memory buffer overflow when handling MIDI output. An attacker who controls a malicious USB device can write far beyond the allocated buffer, potentially corrupting kernel memory and achieving code execution with kernel privileges on systems that have the device connected.
Technical details
The vulnerability is an out-of-bounds write (OOB) in the snd_usbmidi_novation_output() function within the ALSA USB audio subsystem. The root cause is insufficient validation of the USB endpoint's maximum packet size (wMaxPacketSize): when a malformed device advertises a wMaxPacketSize of 1, the code calculates ep->max_transfer as 1, resulting in a negative buffer length (-1) being passed to snd_rawmidi_transmit(). This negative size is misinterpreted as an extremely large unsigned value by subsequent memcpy() calls, causing the write to exceed the coherently allocated transfer buffer. The vulnerability requires a local USB device (or virtual USB device) to be connected to the system; exploitation occurs automatically upon device connection without user interaction. A patch was introduced that adds a simple bounds check, ensuring ep->max_transfer is at least 3 bytes before proceeding with the transmission.
Affected products
- Linux Linux kernel 2.6.12-rc2 and later (before patch)
Timeline
- 2026-09-04: disclosed: CVE-2026-80829 published
- 2026-08-24: patched: Fix merged upstream (commit 1035a8f63bae28e498b0e7b5ac91d749844a7158)
- 2026-09-02: patched: Fix backported to stable branches (commit 1074c2306901b44ebcb83855583c6776e1e392ea)