CVE-2026-80829
Received Received - Intake

Out-of-Bounds Write in Linux Kernel USB Audio Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() snd_usbmidi_novation_output() lays out a two-byte header at transfer_buffer[0..1] and passes &transfer_buffer[2] together with a length of ep->max_transfer - 2 to snd_rawmidi_transmit(): count = snd_rawmidi_transmit(ep->ports[0].substream, &transfer_buffer[2], ep->max_transfer - 2); ep->max_transfer comes from the output endpoint's wMaxPacketSize via usb_maxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->max_transfer becomes 1 and the count argument becomes -1. snd_rawmidi_transmit() passes the negative count on to __snd_rawmidi_transmit_peek(), where "if (count1 > count) count1 = count" leaves count1 negative; get_aligned_size() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (size_t)-1 length and writes far past the transfer buffer, which was allocated with usb_alloc_coherent(ep->max_transfer). This is the same class of bug that was fixed for snd_usbmidi_akai_output() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80829
EUVD
EUVD-2026-71279

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds (OOB) write vulnerability in the Linux kernel's ALSA USB audio driver. It occurs in the snd_usbmidi_novation_output() function when handling USB MIDI devices. A malicious device can advertise a small packet size, causing the driver to write data beyond allocated memory during MIDI transmission.

Detection Guidance

This vulnerability affects the Linux kernel's ALSA USB audio MIDI driver. Detection requires checking kernel versions and USB audio device interactions. No direct network detection commands are available. Inspect kernel logs for USB audio errors or OOB write warnings after connecting suspicious USB MIDI devices.

Impact Analysis

This vulnerability could allow an attacker with physical access to a vulnerable system to cause memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It specifically affects systems using USB MIDI devices with the Linux kernel.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80829. Avoid connecting untrusted USB MIDI devices. If immediate patching is not possible, disable the snd_usbmidi_novation module using modprobe -r snd_usbmidi_novation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart