CVE-2026-52964

Analyzed Analyzed - Analysis Complete

USB MIDI 2.0 Endpoint Descriptor Parsing Flaw

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It validates bLength against bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the remaining bytes in the endpoint-extra scan. A malformed device can therefore make later baAssoGrpTrmBlkID[] reads consume bytes past the walked descriptor. Reject zero-length and overlong descriptors while walking endpoint extras.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52964

EUVD

EUVD-2026-38832

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 6.5 (inc) to 6.6.141 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's ALSA USB audio subsystem, specifically in the USB MIDI 2.0 endpoint parser. The parser uses the same descriptor scanning pattern as the legacy MIDI parser but does not properly validate the length of certain descriptors against the remaining bytes available. As a result, a malformed USB MIDI 2.0 device can cause the parser to read beyond the intended descriptor boundaries, potentially consuming extra bytes and causing unexpected behavior.

Impact Analysis

The impact of this vulnerability is that a malformed USB MIDI 2.0 device could cause the Linux kernel to read beyond the intended memory boundaries when parsing endpoint descriptors. This could lead to memory corruption or other unintended behavior within the kernel, potentially affecting system stability or security.

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by rejecting zero-length and overlong descriptors while walking endpoint extras in the USB MIDI 2.0 endpoint parser.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-52964. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70