CVE-2026-52964

What it actually does

This is an out-of-bounds read in the Linux kernel ALSA USB audio driver’s USB MIDI 2.0 endpoint descriptor parser. A malformed USB audio/MIDI device can provide endpoint-extra descriptors whose length fields appear valid for one check but exceed the remaining descriptor bytes being walked, causing the kernel parser to read past the current descriptor while processing baAssoGrpTrmBlkID entries. The most likely impacts are kernel memory safety violations, device-probe failure, kernel warning/oops, or system crash; depending on kernel configuration and surrounding memory layout, limited information exposure may also be possible. The issue is local/physically adjacent in typical deployments because exploitation requires presenting a malicious USB device, or a virtual USB device through USB/IP, hypervisor passthrough, emulation, or similar device-forwarding mechanisms.

Why it matters to the business

Successful exploitation can destabilize Linux workstations, kiosks, audio-production systems, embedded appliances, servers with USB passthrough, or virtualization hosts/guests that accept untrusted USB devices. The operational risk is primarily denial of service through kernel crashes or repeated device-triggered failures when a malicious peripheral is connected. Internet-scale exploitation is unlikely based on the low EPSS score, lack of known exploitation, and absence from the CISA KEV catalog, but organizations with exposed USB workflows, public-access machines, device testing labs, or USB passthrough should treat it as a practical local attack path.

How an attack unfolds

An attacker prepares a malicious USB audio/MIDI 2.0 device or a software-emulated USB device with crafted endpoint-extra descriptors. When the device is connected or passed through to a Linux system, the kernel enumerates the USB device and loads/probes the ALSA snd-usb-audio path. During MIDI 2.0 endpoint parsing, the malformed descriptor advertises group terminal block data in a way that passes the parser’s initial length validation but does not fit within the remaining bytes of the descriptor-walking buffer. The parser then reads beyond the intended descriptor boundary. In a vulnerable kernel, this may result in a kernel memory-safety fault, KASAN report, oops, panic, or other unstable behavior during device initialization. There is no indication that this issue is currently exploited in the wild or used by named threat actors or ransomware campaigns.

How to fix it

Apply a Linux kernel update that includes the ALSA usb-audio fix for bounded USB MIDI 2.0 endpoint descriptor scanning. Because no product-specific fixed versions were provided, use the relevant distribution, appliance, vendor, or long-term-stable kernel advisory to identify the first patched kernel for each supported platform. Prioritize systems that allow physical USB access, run shared workstations or kiosks, perform USB device testing, or expose USB devices to guests through virtualization, USB/IP, containers, or remote-device forwarding. If immediate patching is not possible, reduce exposure by disabling or restricting untrusted USB device attachment, blocking USB audio/MIDI class devices where operationally feasible, disabling USB passthrough to guests, enforcing USB device allowlisting, and limiting physical access to ports.

How to confirm the fix worked

Confirm that deployed kernels include the upstream or vendor-backported ALSA usb-audio change that rejects zero-length and overlong endpoint-extra descriptors during USB MIDI 2.0 parsing. Validate through vendor package metadata, distribution security advisories, kernel changelogs, or source/backport inspection rather than relying only on the upstream version number, since many distributions backport fixes. On representative systems, verify the running kernel after reboot and confirm that USB audio/MIDI functionality still works for approved devices. For higher-assurance validation in device-testing environments, use a controlled malformed USB descriptor test or USB fuzzing harness and confirm that the patched kernel rejects the device cleanly without KASAN, oops, panic, or snd-usb-audio memory-safety warnings.

Typical attack path

1. Obtain physical access to a target system, public USB port, test bench, or an environment that accepts USB passthrough/USB emulation.
2. Prepare a malicious USB audio/MIDI 2.0 peripheral or virtual USB device with malformed endpoint-extra descriptors.
3. Connect or present the device to the vulnerable Linux system.
4. Allow the kernel USB subsystem and ALSA snd-usb-audio driver to enumerate and parse the device descriptors.
5. Trigger the out-of-bounds descriptor read during MIDI 2.0 endpoint parsing.
6. Cause a kernel warning, driver failure, system crash, or other memory-safety side effect depending on kernel build and runtime conditions.

How to detect it

To assess possible prior exploitation, review kernel ring buffer logs, systemd journal, syslog, crash dumps, audit logs, udev logs, endpoint USB inventory, and hypervisor/USB-passthrough logs. Focus on unexpected USB audio or MIDI device insertions followed by kernel warnings, KASAN reports, oops, panic, reboots, or snd-usb-audio probe failures. Correlate timestamps for device enumeration messages with system instability, especially where the device class is audio, MIDI, or composite USB. In virtualized environments, also review management-plane records for newly attached or passed-through USB devices. Because this vulnerability does not inherently create a persistent file, process, account, registry key, or network beacon, absence of a durable IOC does not rule out attempted exploitation; evidence is most likely transient kernel/device telemetry and crash artifacts.

• snd_usb_audio
• usb-audio
• ALSA
• MIDI 2.0
• baAssoGrpTrmBlkID
• bNumGrpTrmBlock
• BUG: KASAN: slab-out-of-bounds
• BUG: KASAN: out-of-bounds
• kernel BUG
• Oops:
• Kernel panic
• usbcore: registered new interface driver snd-usb-audio
• New USB device found
• new high-speed USB device
• new full-speed USB device
• new SuperSpeed USB device

What your security team should do

• Inventory Linux systems where USB devices can be connected or passed through, prioritizing public-access endpoints, engineering workstations, kiosks, audio/MIDI systems, embedded devices, hypervisors, and device-testing labs.
• Patch affected Linux kernels using vendor-supported packages and confirm that systems have rebooted into the fixed kernel.
• Temporarily restrict untrusted USB audio/MIDI devices and disable USB passthrough or USB/IP exposure where not required.
• Enable or review USB device allowlisting controls for high-risk systems.
• Monitor kernel logs for crashes or memory-safety reports involving snd-usb-audio, usb-audio, ALSA, or MIDI descriptor parsing after suspicious USB insertions.
• For forensic triage, correlate kernel oops/panic events with USB insertion events, udev activity, console access, hypervisor USB passthrough events, and newly observed USB vendor/product identifiers.
• Do not treat the low EPSS score as a reason to ignore patching on systems with realistic USB exposure; the attack surface is local but practical where peripherals are untrusted.