CVE-2023-54022
Memory Leak in Linux Kernel ALSA USB-Audio MIDI 2.0 Component
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a potential memory leak in the Linux kernel's ALSA usb-audio driver related to MIDI 2.0 / UMP devices. Specifically, when an error occurs during allocation and initialization in the alloc_midi_urbs() function, the cleanup function free_midi_urbs() does not release all allocated memory because it loops based on an outdated count of entries. This causes some memory not to be freed immediately, leading to a memory leak. The fix involves changing the loop to cover all elements and adding a missing call to free_midi_urbs() in the error path to release memory promptly.
How can this vulnerability impact me? :
This vulnerability can lead to memory leaks in the Linux kernel when using USB audio devices with MIDI 2.0 / UMP support. Over time, these leaks could consume system memory unnecessarily, potentially degrading system performance or causing instability if the leaks accumulate significantly.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the ALSA usb-audio component has the fix for the memory leak in alloc_midi_urbs(), specifically where free_midi_urbs() properly releases all elements and is called at the error path in snd_usb_midi_v2_open().