CVE-2026-80829ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() snd_usbmidi_novation_output() lays out a two-byte header at transfer_buffer[0..1] and passes &transfer_buffer[2] together with a length of ep->max_transfer - 2 to snd_rawmidi_transmit(): count = snd_rawmidi_transmit(ep->ports[0].substream, &transfer_buffer[2], ep->max_transfer - 2); ep->max_transfer comes from the output endpoint's wMaxPacketSize via usb_maxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->max_transfer becomes 1 and the count argument becomes -1. snd_rawmidi_transmit() passes the negative count on to __snd_rawmidi_transmit_peek(), where "if (count1 > count) count1 = count" leaves count1 negative; get_aligned_size() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (size_t)-1 length and writes far past the transfer buffer, which was allocated with usb_alloc_coherent(ep->max_transfer). This is the same class of bug that was fixed for snd_usbmidi_akai_output() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 558fc4485ecc704edfe7876d6cebae4738ff7ef8; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9c8212436631b0063cb021e9f58df438e3db84d0; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e9c00d7533f99aa9833c4b598f47e3b3202fdb9a; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 94e4562fcc81badd1d467ddfb88c27e4fae974c2; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7639ec9755d3ec0ec8cd7c0fdd2c3d3997434870; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 91919b3b99ab7ce3d7dbb39fcf7c6c742a663c0c; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7f00dbddb51f4f74325cdc7c3f6b19fb3392481a; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1074c2306901b44ebcb83855583c6776e1e392ea; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/558fc4485ecc704edfe7876d6cebae4738ff7ef8
- https://git.kernel.org/stable/c/9c8212436631b0063cb021e9f58df438e3db84d0
- https://git.kernel.org/stable/c/e9c00d7533f99aa9833c4b598f47e3b3202fdb9a
- https://git.kernel.org/stable/c/94e4562fcc81badd1d467ddfb88c27e4fae974c2
- https://git.kernel.org/stable/c/7639ec9755d3ec0ec8cd7c0fdd2c3d3997434870
- https://git.kernel.org/stable/c/91919b3b99ab7ce3d7dbb39fcf7c6c742a663c0c
- https://git.kernel.org/stable/c/7f00dbddb51f4f74325cdc7c3f6b19fb3392481a
- https://git.kernel.org/stable/c/1074c2306901b44ebcb83855583c6776e1e392ea
- https://git.kernel.org/stable/c/1035a8f63bae28e498b0e7b5ac91d749844a7158
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.