CVE-2022-49772

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()

snd_usbmidi_output_open() has a check of the NULL port with snd_BUG_ON(). snd_BUG_ON() was used as this shouldn't have happened, but in reality, the NULL port may be seen when the device gives an invalid endpoint setup at the descriptor, hence the driver skips the allocation. That is, the check itself is valid and snd_BUG_ON() should be dropped from there. Otherwise it's confusing as if it were a real bug, as recently syzbot stumbled on it.

The snd_usbmidi_output_open() function previously included a snd_BUG_ON() assertion for a NULL port pointer. However, such a condition can occur legitimately when a device exposes an invalid USB descriptor (e.g., endpoint setup is missing or incorrect). This patch replaces the BUG_ON with a graceful return of -ENXIO, avoiding misleading kernel warnings or panics. The change prevents unnecessary kernel warning output in cases of non-malicious, invalid USB MIDI device configurations. This improves robustness and avoids confusing debug messages when such devices are connected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.