NetSight
IP …
medium5.5

CVE-2026-52963

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans snd_usbmidi_get_ms_info() validates t…

Impact

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan. Stop walking when bLength is zero or extends past the remaining endpoint-extra scan.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.4.238 before 4.5
from 4.9.238 before 4.10
from 4.14.200 before 4.15
from 4.19.149 before 4.20
from 5.4.69 before 5.5
from 5.7 before 5.10.258

References