CVE-2026-90033

A flaw was found in the Linux kernel's ALSA USB audio subsystem. The snd_usbmidi_us122l_output() function, responsible for handling USB MIDI output, incorrectly calculates the buffer size for devices operating at slower than high speed. This error can lead to an out-of-bounds write, where the system attempts to write data beyond the allocated memory buffer. A local attacker with physical access to a malicious USB device could potentially exploit this to cause memory corruption, leading to a denial of service or other unpredictable system behavior.

An out of bounds write in the ALSA USB MIDI output path can occur because snd_usbmidi_us122l_output() selects a count of 2 for slower than high speed devices without checking that ep max_transfer is at least that large. A device that exposes a one byte bulk endpoint can make the URB transfer buffer smaller than the requested MIDI transmit length, and the later padding calculation can underflow from 1 minus 2 into a very large size. This can corrupt kernel memory or crash the kernel when MIDI output is sent to the device. For the CVSS the PR:L is used for the paranoid score because a local user or process with access to the ALSA rawmidi device can plausibly trigger the transmit path when such a device is present. The issue is not network reachable and normally requires a local USB device or a malformed USB peripheral. Impact is at least denial of service via kernel crash, with a defensible worst case of confidentiality and integrity impact because the primitive is an out of bounds kernel write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.