CVE-2026-52963

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) USB audio driver. The driver's handling of MIDI (Musical Instrument Digital Interface) endpoint descriptors did not properly bound scans, allowing it to read beyond the intended memory buffer. This out-of-bounds read could potentially lead to information disclosure or cause system instability.

A malformed USB MIDI endpoint extra descriptor can make the ALSA usb-audio descriptor walker accept a class specific endpoint descriptor whose bLength extends beyond the remaining endpoint extra buffer. Later MIDIStreaming parsing can then read flexible array fields such as baAssocJackID using bLength rather than the real remaining buffer size, creating an out-of-bounds read in kernel context. For the CVSS the PR:N is used because a malicious USB device can trigger descriptor parsing without requiring an account or privileges on the target system. The attack vector is physical because the attacker normally needs to attach or emulate a malicious USB device. Impact is at least a local physical denial of service or limited kernel memory exposure through invalid descriptor parsing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.