CVE-2026-74499

A flaw was found in the kernel's Advanced Linux Sound Architecture (ALSA) USB audio driver. An integer overflow vulnerability in the snd_usbmidi_akai_output() function, when processing data from a USB device with a small bulk-OUT endpoint, can lead to an out-of-bounds write in the kernel heap. A local attacker, by writing to a MIDI device node with a specially crafted USB device, could exploit this to achieve arbitrary code execution or cause a denial of service.

This vulnerability is rated as having a Moderate impact because exploitation requires attaching a manipulated USB peripheral and local permissions to write to the corresponding ALSA MIDI device node. In standard Red Hat Enterprise Linux deployments, physical access to USB ports is strictly controlled and MIDI hardware is uncommon. Systems remain at risk primarily where untrusted USB peripherals can be introduced or where guest virtual machines utilize USB device passthrough.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.