Cloudanix VulnDB

CVE-2026-80829

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Plugging a specially made USB music device into a Linux computer can damage the system's internal memory and cause crashes or security problems.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in snd_usbmidi_novation_output() when a USB device advertises wMaxPacketSize=1, causing ep->max_transfer-2 to become negative and snd_rawmidi_transmit() to pass a (size_t)-1 length to memcpy() beyond the usb_alloc_coherent buffer.

Why it matters to the business

Malicious or malformed USB devices can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation on systems handling USB audio/MIDI hardware.

How an attack unfolds

Attacker supplies a USB device that reports a bulk OUT endpoint with wMaxPacketSize of 1 during enumeration. The ALSA usb-audio driver computes a negative count for snd_rawmidi_transmit, which propagates through __snd_rawmidi_transmit_peek and get_aligned_size, resulting in an unbounded memcpy write past the allocated transfer buffer.

How to fix it

Apply the upstream kernel patch that adds an early return when ep->max_transfer cannot accommodate the two-byte header plus at least one payload byte; update to a kernel release containing commit equivalent to the referenced fix.

How to confirm the fix worked

Confirm the presence of the size check (ep->max_transfer >= 3) in snd_usbmidi_novation_output() and test with a USB device emulator advertising wMaxPacketSize=1 to ensure no crash or corruption occurs.

Typical attack path

  1. Attacker presents malicious USB device to target system
  2. USB core enumerates endpoint and sets ep->max_transfer=1
  3. ALSA driver calls snd_usbmidi_novation_output without size validation
  4. Negative length reaches memcpy, corrupting adjacent kernel memory

How to detect it

Review kernel logs for ALSA usb-audio warnings or oops related to snd_usbmidi_novation_output or negative transfer lengths; inspect dmesg for unexpected USB bulk endpoints reporting wMaxPacketSize of 1.

  • snd_usbmidi_novation_output
  • wMaxPacketSize of 1
  • ep->max_transfer - 2

What your security team should do

  • Prioritize kernel updates on all systems that may accept USB audio devices
  • Disable USB audio/MIDI support via kernel config or module blacklist where not required
  • Enforce USB device allow-listing or physical port controls for high-risk environments

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() snd_usbmidi_novation_output() lays out a two-byte header at transfer_buffer[0..1] and passes &transfer_buffer[2] together with a length of ep->max_transfer - 2 to snd_rawmidi_transmit(): count = snd_rawmidi_transmit(ep->ports[0].substream, &transfer_buffer[2], ep->max_transfer - 2); ep->max_transfer comes from the output endpoint's wMaxPacketSize via usb_maxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->max_transfer becomes 1 and the count argument becomes -1. snd_rawmidi_transmit() passes the negative count on to __snd_rawmidi_transmit_peek(), where "if (count1 > count) count1 = count" leaves count1 negative; get_aligned_size() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (size_t)-1 length and writes far past the transfer buffer, which was allocated with usb_alloc_coherent(ep->max_transfer). This is the same class of bug that was fixed for snd_usbmidi_akai_output() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.

Affected packages

Ecosystem Package Introduced Fixed