CVE-2026-80829

A flaw was found in the Linux kernel's ALSA USB audio driver. A local attacker with a specially crafted USB device could exploit this vulnerability. By providing a malformed wMaxPacketSize value, the device can trigger an out-of-bounds write in the kernel's memory. This memory corruption could lead to a system crash, resulting in a denial of service, or potentially allow for arbitrary code execution.

A kernel OOB write in ALSA USB MIDI occurs because snd_usbmidi_novation_output() subtracts a 2-byte header from ep max_transfer without first checking that the endpoint can hold the header and at least one payload byte. A malformed or malicious USB MIDI device can advertise a bulk OUT endpoint with wMaxPacketSize 1, making the transmit count negative and allowing a later memcpy to treat it as a very large size_t length. For the CVSS the PR:N because the attacker does not need an account on the target if the malicious USB device can be attached or supplied to the victim. The issue is not network reachable and normally requires physical USB device access or victim interaction with an untrusted USB MIDI device. Impact is at least denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.