CVE-2026-80829: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput()
sndusbmidinovationoutput() lays out a two-byte header at transferbuffer[0..1] and passes &transferbuffer[2] together with a length of ep->maxtransfer - 2 to sndrawmiditransmit():
count = sndrawmiditransmit(ep->ports[0].substream, &transferbuffer[2], ep->maxtransfer - 2);
ep->maxtransfer comes from the output endpoint's wMaxPacketSize via usbmaxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->maxtransfer becomes 1 and the count argument becomes -1.
sndrawmiditransmit() passes the negative count on to sndrawmiditransmitpeek(), where "if (count1 > count) count1 = count" leaves count1 negative; getalignedsize() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (sizet)-1 length and writes far past the transfer buffer, which was allocated with usballoccoherent(ep->maxtransfer).
This is the same class of bug that was fixed for sndusbmidiakaioutput() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
An attacker needs a malformed or malicious USB device that advertises a bulk OUT endpoint with a wMaxPacketSize of 1. When the system uses the affected Novation USB-MIDI output path, that value causes a negative transmit length and an out-of-bounds write.
How can I determine whether a system is exposed?
Exposure depends on running a Linux kernel with the ALSA usb-audio driver and connecting a device that can present the malformed bulk OUT endpoint descriptor. The provided data does not identify affected kernel versions; compare the kernel's applied fixes with the referenced stable commits.
What is the risk if the issue is triggered?
The negative length is converted to a size_t value of -1 for memcpy, causing a write far beyond the USB transfer buffer. This is a kernel memory-safety issue.