Executive brief
The Linux kernel's USB audio MIDI driver contains a buffer overflow vulnerability in the US-122L output handler. When certain USB MIDI devices report small maximum transfer sizes, the driver attempts to write more data than the buffer can hold, potentially corrupting kernel memory and causing system crashes or enabling privilege escalation through a locally connected USB device.
Technical details
The vulnerability is an out-of-bounds (OOB) write in the snd_usbmidi_us122l_output() function in sound/usb/midi.c. The function hardcodes a data count of 2 bytes for non-high-speed USB devices without validating this value against the endpoint's maximum transfer size (ep->max_transfer). When a USB MIDI device declares a smaller maximum transfer size (e.g., 1 byte), the driver attempts to read 2 bytes into a buffer that cannot accommodate them, causing a buffer overflow. Additionally, the memset padding calculation (max_transfer - count) wraps to SIZE_MAX when max_transfer is smaller than count, leading to massive memory corruption. The fix adds a guard to check if ep->max_transfer is less than the intended count and aborts the operation if so, consistent with mitigations applied to other output operations in the same file.
Affected products
- Linux Linux kernel multiple versions prior to the patch (linux-3.x and later through 6.x series)
Timeline
- 2026-09-16: disclosed: CVE-2026-90033 published
- 2026-09-14: patched: Patch merged into stable kernel via commits 1d4add2b and 2dae0e3a