ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
Summary
| CVE | CVE-2026-74499 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-08-15 13:17:54 UTC |
|---|
| Updated | 2026-08-15 13:17:54 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
snd_usbmidi_akai_output() computes its fill-loop bound
buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1;
as a signed int, so a small device-advertised bulk-OUT max_transfer
makes buf_end negative. The loop guard then compares the u32
urb->transfer_buffer_length against that negative int: the usual
arithmetic conversion turns buf_end into a large unsigned value, so the
guard stays true and each iteration keeps appending SysEx framing and
payload bytes past the end of the URB transfer buffer, which is only
max_transfer bytes long.
A USB device that advertises a tiny bulk-OUT endpoint can therefore
trigger an attacker-length- and content-controlled heap out-of-bounds
write when a process writes to the created /dev/snd/midiC*D* node.
Return early when there is no room for even one SysEx, so the loop is
never entered with a bound that would wrap. The loop is the last
statement of the function, so bailing out is equivalent to it not
running.
Discovered by XBOW, triaged by Baul Lee <[email protected]> |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 4434ade8c9334a3ab975d8993de456f06841899e 29a4c29943631301e85f5e9d10f25741bd78e7ba git |
Not specified |
| CNA |
Linux |
Linux |
affected 4434ade8c9334a3ab975d8993de456f06841899e 9b22a5c8310b0d55d04f5f0159b913a2fb8b444f git |
Not specified |
| CNA |
Linux |
Linux |
affected 4434ade8c9334a3ab975d8993de456f06841899e b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4434ade8c9334a3ab975d8993de456f06841899e 2b7a0f330dd90dd1a7657cec0db019ee1efa4372 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4434ade8c9334a3ab975d8993de456f06841899e 0970274613fb463d376211450cab066d34ebfe6a git |
Not specified |
| CNA |
Linux |
Linux |
affected 2.6.35 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 2.6.35 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.151 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.103 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.44 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.1.8 7.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2-rc6 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/29a4c29943631301e85f5e9d10f25741bd78e7ba |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/9b22a5c8310b0d55d04f5f0159b913a2fb8b444f |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/2b7a0f330dd90dd1a7657cec0db019ee1efa4372 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/0970274613fb463d376211450cab066d34ebfe6a |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.