CVE-2026-98770
Received Received - Intake

Buffer Overflow in Linux Kernel USB Gadget MIDI2 Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct f_midi2_usb_config have the size of MAX_CABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for those arrays are added from both inputs and outputs, hence for each loop cycle, it adds two, ended up with as twice as the expected size. This inconsistency may result in potential OOB when a large number of jacks are set up via configfs, although the max number of cables (the loop count) is limited to MAX_CABLES. For addressing it, correct the jack_ins & jack_outs array sizes to twice, MAX_CABLES * 2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98770
EUVD
EUVD-2026-103855

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 856fa444b0982746f95e801bab0e586533eb29a3
Linux Linux 856fa444b0982746f95e801bab0e586533eb29a3
Linux Linux 856fa444b0982746f95e801bab0e586533eb29a3
Linux Linux 856fa444b0982746f95e801bab0e586533eb29a3
Linux Linux 6.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel related to USB gadget MIDI2 functionality. The issue involves incorrect array sizes for jack descriptor arrays in struct f_midi2_usb_config. The arrays jack_ins and jack_outs are sized for MAX_CABLES but should be twice that size because each loop cycle adds two entries (one for input and one for output). This can lead to out-of-bounds (OOB) memory access when many jacks are configured via configfs, even though the maximum number of cables is limited.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget MIDI2 implementation and may not have direct network detection methods. Check kernel logs for USB gadget-related errors or OOB warnings using dmesg | grep -i usb or journalctl -k | grep -i usb. Inspect configfs entries under /sys/kernel/config/usb_gadget/ for abnormal jack descriptor sizes.

Impact Analysis

This vulnerability could allow an attacker to trigger out-of-bounds memory access by configuring a large number of jacks via configfs. This might lead to system crashes, memory corruption, or potentially privilege escalation if exploited. Systems using USB gadget MIDI2 functionality with many configured jacks are at higher risk.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. Monitor kernel updates from your distribution and apply them promptly. If using custom kernels, apply the patch correcting jack descriptor array sizes to MAX_CABLES * 2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart