CVE-2026-52964

A flaw was found in the Linux kernel's ALSA USB audio component. The USB MIDI 2.0 endpoint parser, responsible for handling audio device descriptors, failed to properly validate the length of these descriptors. This vulnerability could allow a local attacker, by connecting a specially crafted malformed USB MIDI 2.0 device, to cause an out-of-bounds read. Such an issue can lead to memory corruption, potentially resulting in information disclosure or a system crash (denial of service).

This vulnerability is classified as Moderate impact because successful exploitation requires physical access to attach a crafted peripheral or local control over virtualized USB redirection, preventing remote attack vectors. In typical Red Hat Enterprise Linux server and cloud deployments, USB audio hardware is absent, significantly limiting real-world exposure. Earlier releases such as RHEL 8 do not include the vulnerable USB MIDI 2.0 code and are not affected. Where exposed, malicious descriptors can trigger an out-of-bounds memory read in the kernel, leading to a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.