Executive brief
A flaw in the Linux kernel's ALSA audio subsystem allows a malicious or specially crafted USB audio device to read memory beyond an allocated buffer and expose it to userspace. When a user connects the device and opens a MIDI input stream, kernel memory bytes following the 64-byte device communication buffer are leaked through the MIDI interface, potentially exposing sensitive kernel data without any user action beyond device insertion.
Technical details
The vulnerability is a buffer over-read in the usb6fire_comm_receiver_handler() function within the snd_usb_6fire driver. The handler processes MIDI events by reading a length byte (receiver_buffer[1], a u8) directly from the device without validation, then passes that many bytes to snd_rawmidi_receive(). Since the receiver_buffer is only 64 bytes total with a 2-byte header, a device claiming a MIDI event length of 0xFF causes a read of 255 bytes from a 64-byte allocation. Additionally, the code does not check urb->actual_length, allowing stale data from previous transfers to be processed. Exploitation requires a malicious USB device and an open MIDI input substream, but occurs automatically at device plug time. The fix validates that the claimed event length does not exceed the buffer bounds (62 bytes after the 2-byte header) and verifies the USB transfer actually delivered the claimed bytes.
Affected products
- Linux Linux kernel 7.2.0-rc5 and likely earlier versions
Timeline
- 2026-09-11: disclosed
- other: KASAN detection on kernel 7.2.0-rc5