{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-74499", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.907Z", "datePublished": "2026-08-15T12:27:25.728Z", "dateUpdated": "2026-08-19T16:38:00.351Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:38:00.351Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()\n\nsnd_usbmidi_akai_output() computes its fill-loop bound\n\n\tbuf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1;\n\nas a signed int, so a small device-advertised bulk-OUT max_transfer\nmakes buf_end negative. The loop guard then compares the u32\nurb->transfer_buffer_length against that negative int: the usual\narithmetic conversion turns buf_end into a large unsigned value, so the\nguard stays true and each iteration keeps appending SysEx framing and\npayload bytes past the end of the URB transfer buffer, which is only\nmax_transfer bytes long.\n\nA USB device that advertises a tiny bulk-OUT endpoint can therefore\ntrigger an attacker-length- and content-controlled heap out-of-bounds\nwrite when a process writes to the created /dev/snd/midiC*D* node.\n\nReturn early when there is no room for even one SysEx, so the loop is\nnever entered with a bound that would wrap. The loop is the last\nstatement of the function, so bailing out is equivalent to it not\nrunning.\n\nDiscovered by XBOW, triaged by Baul Lee " } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/usb/midi.c" ], "versions": [ { "version": "4434ade8c9334a3ab975d8993de456f06841899e", "lessThan": "78dfdeb8d2065524ed5928d6470bf3d3244d1009", "status": "affected", "versionType": "git" }, { "version": "4434ade8c9334a3ab975d8993de456f06841899e", "lessThan": "00cc659a42ac4e94ec880fae2c9bf22fce69c2e8", "status": "affected", "versionType": "git" }, { "version": "4434ade8c9334a3ab975d8993de456f06841899e", "lessThan": "ce949d66607cfb000b8d8d84f80f35a886e72683", "status": "affected", "versionType": "git" }, { "version": "4434ade8c9334a3ab975d8993de456f06841899e", "lessThan": "29a4c29943631301e85f5e9d10f25741bd78e7ba", "status": "affected", "versionType": "git" }, { "version": "4434ade8c9334a3ab975d8993de456f06841899e", "lessThan": "9b22a5c8310b0d55d04f5f0159b913a2fb8b444f", "status": "affected", "versionType": "git" }, { "version": "4434ade8c9334a3ab975d8993de456f06841899e", "lessThan": "b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081", "status": "affected", "versionType": "git" }, { "version": "4434ade8c9334a3ab975d8993de456f06841899e", "lessThan": "2b7a0f330dd90dd1a7657cec0db019ee1efa4372", "status": "affected", "versionType": "git" }, { "version": "4434ade8c9334a3ab975d8993de456f06841899e", "lessThan": "0970274613fb463d376211450cab066d34ebfe6a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/usb/midi.c" ], "versions": [ { "version": "2.6.35", "status": "affected" }, { "version": "0", "lessThan": "2.6.35", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.10.265" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.6.151" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.12.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.18.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "7.1.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/78dfdeb8d2065524ed5928d6470bf3d3244d1009" }, { "url": "https://git.kernel.org/stable/c/00cc659a42ac4e94ec880fae2c9bf22fce69c2e8" }, { "url": "https://git.kernel.org/stable/c/ce949d66607cfb000b8d8d84f80f35a886e72683" }, { "url": "https://git.kernel.org/stable/c/29a4c29943631301e85f5e9d10f25741bd78e7ba" }, { "url": "https://git.kernel.org/stable/c/9b22a5c8310b0d55d04f5f0159b913a2fb8b444f" }, { "url": "https://git.kernel.org/stable/c/b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081" }, { "url": "https://git.kernel.org/stable/c/2b7a0f330dd90dd1a7657cec0db019ee1efa4372" }, { "url": "https://git.kernel.org/stable/c/0970274613fb463d376211450cab066d34ebfe6a" } ], "title": "ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()", "x_generator": { "engine": "bippy-1.2.0" } } } }