CVE-2026-98770usb: gadget: midi2: Fix the jack descriptor array sizes
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct f_midi2_usb_config have the size of MAX_CABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for those arrays are added from both inputs and outputs, hence for each loop cycle, it adds two, ended up with as twice as the expected size. This inconsistency may result in potential OOB when a large number of jacks are set up via configfs, although the max number of cables (the loop count) is limited to MAX_CABLES. For addressing it, correct the jack_ins & jack_outs array sizes to twice, MAX_CABLES * 2.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 856fa444b0982746f95e801bab0e586533eb29a3 before 8294ff75a9de23f7cc641e5e5ca31fa6ea72a574; 856fa444b0982746f95e801bab0e586533eb29a3 builds before 87f2185423e01f113811301878f2f67eccec960d; 856fa444b0982746f95e801bab0e586533eb29a3 builds before 223c3bd02a582776d8ee47dae7b69d3258420694; 856fa444b0982746f95e801bab0e586533eb29a3 builds before 310c2d4608d8c1a2baa57db1dfd319c5c40cf4a1 | CNA record |
References
- https://git.kernel.org/stable/c/8294ff75a9de23f7cc641e5e5ca31fa6ea72a574
- https://git.kernel.org/stable/c/87f2185423e01f113811301878f2f67eccec960d
- https://git.kernel.org/stable/c/223c3bd02a582776d8ee47dae7b69d3258420694
- https://git.kernel.org/stable/c/310c2d4608d8c1a2baa57db1dfd319c5c40cf4a1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.