CVE-2026-80973

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem, specifically within the 6fire driver. This vulnerability allows a malicious USB device to trigger an out-of-bounds read by sending a specially crafted MIDI event with an excessive length. This can lead to the disclosure of sensitive information from kernel memory. The issue can be triggered upon device connection without requiring user interaction, provided a MIDI input substream is open.

A slab out-of-bounds read in the ALSA usb 6fire MIDI receive path occurs because usb6fire_comm_receiver_handler trusted a length byte supplied by the USB device without bounding it to the 62 bytes available after the two byte header. A malicious or emulated device can report a MIDI event type 0x10 with an excessive length such as 0xff, causing snd_rawmidi_receive to read beyond the 64 byte receiver buffer and potentially expose adjacent kernel heap bytes through the rawmidi read path. For the CVSS the PR:N because the attacker does not need an account on the victim and only needs control of the attached USB device behavior. UI:R is used because the victim side normally needs device attachment and a MIDI input substream must be open for forwarding to userspace. The issue is not network reachable in the usual deployment model. Impact is primarily kernel memory disclosure with possible denial of service if the out-of-bounds read faults or is caught by hardening.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.