CVE-2026-74499

Received Received - Intake

Out-of-Bounds Write in Linux Kernel ALSA USB Audio

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-advertised bulk-OUT max_transfer makes buf_end negative. The loop guard then compares the u32 urb->transfer_buffer_length against that negative int: the usual arithmetic conversion turns buf_end into a large unsigned value, so the guard stays true and each iteration keeps appending SysEx framing and payload bytes past the end of the URB transfer buffer, which is only max_transfer bytes long. A USB device that advertises a tiny bulk-OUT endpoint can therefore trigger an attacker-length- and content-controlled heap out-of-bounds write when a process writes to the created /dev/snd/midiC*D* node. Return early when there is no room for even one SysEx, so the loop is never entered with a bound that would wrap. The loop is the last statement of the function, so bailing out is equivalent to it not running. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74499

EUVD

EUVD-2026-59692

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's ALSA USB-audio driver. It involves an out-of-bounds (OOB) write in the snd_usbmidi_akai_output() function. The issue occurs when a small USB device advertises a tiny bulk-OUT max_transfer size, causing a signed integer overflow that leads to a large unsigned value. This causes a loop to write past the end of a buffer, enabling a heap OOB write controlled by an attacker.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA USB-audio driver and requires local system access to detect. Check if your system is running a vulnerable kernel version with uname -a. Monitor USB device interactions via dmesg or journalctl for unusual activity. No direct network detection methods are applicable.

Impact Analysis

An attacker could exploit this by connecting a malicious USB device to a system with the vulnerable kernel. If a process interacts with the /dev/snd/midiC*D* node, the attacker could trigger a heap out-of-bounds write, potentially leading to arbitrary code execution, system crashes, or privilege escalation on the affected system.

Compliance Impact

This vulnerability allows an attacker to trigger a heap out-of-bounds write via a USB device with a small bulk-OUT endpoint. This could potentially lead to arbitrary code execution or memory corruption, which may compromise data integrity and confidentiality. Such risks could impact compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access or modification of sensitive data.

Mitigation Strategies

Update your Linux kernel to the latest patched version immediately. If immediate updating is not possible, disable USB MIDI audio devices via kernel module blacklisting (snd_usb_audio) or restrict access to /dev/snd/midi* device nodes. Monitor for suspicious USB device connections.

Hi! I’m here to help you understand CVE-2026-74499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70