Cloudanix VulnDB

CVE-2026-98770

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in how a USB music device feature counts its connections inside the Linux kernel could let someone crash the system or take control when many connections are set up.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Undersized descriptor arrays in the MIDI2 USB gadget driver allow out-of-bounds memory access when more than MAX_CABLES jacks are registered through configfs because entries from both inputs and outputs are stored in the same arrays.

Why it matters to the business

Devices exposing USB MIDI2 gadgets can experience kernel crashes or memory corruption when large numbers of jacks are configured, potentially leading to denial of service or local privilege escalation on affected Linux systems.

How an attack unfolds

An attacker with access to configfs on a system exposing the MIDI2 USB gadget creates a configuration that registers inputs and outputs exceeding the array capacity, triggering an out-of-bounds read or write during descriptor setup and potentially allowing kernel memory manipulation.

How to fix it

Update the Linux kernel to a version containing the fix that resizes the jack_ins and jack_outs arrays to MAX_CABLES * 2. Rebuild and deploy the updated kernel on all affected systems before exposing MIDI2 gadgets via configfs.

How to confirm the fix worked

Confirm the kernel source contains the corrected array sizes (MAX_CABLES * 2) in struct f_midi2_usb_config and that the driver initializes without warnings for maximum jack counts. Test gadget creation with MAX_CABLES inputs and outputs.

Typical attack path

  1. Obtain local access or control over configfs on a target system exposing the MIDI2 gadget
  2. Write a gadget configuration via configfs that registers a large number of input and output jacks
  3. Trigger gadget initialization or USB descriptor generation to induce the out-of-bounds access
  4. Leverage resulting memory corruption for kernel code execution or denial of service

How to detect it

Review kernel logs for USB gadget or MIDI2 related oops, warnings about descriptor sizes, or memory access violations during configfs writes. Correlate with processes writing to /config/usb_gadget.

What your security team should do

  • Prioritize kernel updates on any system that exposes USB gadgets through configfs
  • Restrict configfs access to trusted processes only until patches are applied
  • Monitor for kernel oops or panic events related to USB gadget initialization

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct f_midi2_usb_config have the size of MAX_CABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for those arrays are added from both inputs and outputs, hence for each loop cycle, it adds two, ended up with as twice as the expected size. This inconsistency may result in potential OOB when a large number of jacks are set up via configfs, although the max number of cables (the loop count) is limited to MAX_CABLES. For addressing it, correct the jack_ins & jack_outs array sizes to twice, MAX_CABLES * 2.

Affected packages

Ecosystem Package Introduced Fixed