CVE-2026-80829: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

Published Sep 4, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput()

sndusbmidinovationoutput() lays out a two-byte header at transferbuffer[0..1] and passes &transferbuffer[2] together with a length of ep->maxtransfer - 2 to sndrawmiditransmit():

count = sndrawmiditransmit(ep->ports[0].substream, &transferbuffer[2], ep->maxtransfer - 2);

ep->maxtransfer comes from the output endpoint's wMaxPacketSize via usbmaxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->maxtransfer becomes 1 and the count argument becomes -1.

sndrawmiditransmit() passes the negative count on to sndrawmiditransmitpeek(), where "if (count1 > count) count1 = count" leaves count1 negative; getalignedsize() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (sizet)-1 length and writes far past the transfer buffer, which was allocated with usballoccoherent(ep->maxtransfer).

This is the same class of bug that was fixed for sndusbmidiakaioutput() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.

Affected Software

1 affected component
Linux ALSA usb-audio

Event History

Sep 4, 2026
CVE Published
via MITRE·03:54 PM
Data Sourced
via MITRE·03:54 PM
Description

Frequently Asked Questions

1

What must an attacker control to trigger this issue?

An attacker needs a malformed or malicious USB device that advertises a bulk OUT endpoint with a wMaxPacketSize of 1. When the system uses the affected Novation USB-MIDI output path, that value causes a negative transmit length and an out-of-bounds write.

2

How can I determine whether a system is exposed?

Exposure depends on running a Linux kernel with the ALSA usb-audio driver and connecting a device that can present the malformed bulk OUT endpoint descriptor. The provided data does not identify affected kernel versions; compare the kernel's applied fixes with the referenced stable commits.

3

What is the risk if the issue is triggered?

The negative length is converted to a size_t value of -1 for memcpy, causing a write far beyond the USB transfer buffer. This is a kernel memory-safety issue.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203