CVE-2026-52963

ALSA: usb-audio: Bound MIDI endpoint descriptor scans

State: Published
Severity: Not scored
Published: Jun 24, 2026
Updated: Jun 24, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Bound MIDI endpoint descriptor scans

snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan.

That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan.

Stop walking when bLength is zero or extends past the remaining endpoint-extra scan.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before e2f1260a056eb3215c13c48c5378f3e4112dc3afAffected 5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before c65b137d351e21cbc5630e73ef0eb1e1d75f5b20Affected 5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before 728ab0c72e49ca27185067984cd565425eb69b2eAffected 5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before 3d3b2b01a3e73828e201ece96f863e7a3e0cdc6eAffected 5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before a0226560540c16717efcceaf15c862cf115b01d3Affected 5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before 09141583bd97f4bbd7358e29fd138fe798467cdbAffected 5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before c59159ce10e75b568cd0d4b29efcb0fb0ddecc94Affected 5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before d6854daa67be623860f4e1873fd3d3c275aba4edAffected 9e0c71f2f633b0442661966228827d1a33df485fAffected 0868bc5654c07628c421547f0821650a8c2cb8f3Affected 78483c1c7741ffa72991d93d19a75bfdcc2cbf57Affected 65d95462001c6ccd9bc9499c1fc9a90eca9de496Affected ca767cf0152d18fc299cde85b18d1f46ac21e1baAffected 4.4.238 to before 4.5Affected 4.9.238 to before 4.10Affected 4.14.200 to before 4.15Affected 4.19.149 to before 4.20Affected 5.4.69 to before 5.5Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before e2f1260a056eb3215c13c48c5378f3e4112dc3afAffected
5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before c65b137d351e21cbc5630e73ef0eb1e1d75f5b20Affected
5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before 728ab0c72e49ca27185067984cd565425eb69b2eAffected
5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before 3d3b2b01a3e73828e201ece96f863e7a3e0cdc6eAffected
5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before a0226560540c16717efcceaf15c862cf115b01d3Affected
5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before 09141583bd97f4bbd7358e29fd138fe798467cdbAffected
5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before c59159ce10e75b568cd0d4b29efcb0fb0ddecc94Affected
5c6cd7021a05a02fcf37f360592d7c18d4d807fb to before d6854daa67be623860f4e1873fd3d3c275aba4edAffected
9e0c71f2f633b0442661966228827d1a33df485fAffected
0868bc5654c07628c421547f0821650a8c2cb8f3Affected
78483c1c7741ffa72991d93d19a75bfdcc2cbf57Affected
65d95462001c6ccd9bc9499c1fc9a90eca9de496Affected
ca767cf0152d18fc299cde85b18d1f46ac21e1baAffected
4.4.238 to before 4.5Affected
4.9.238 to before 4.10Affected
4.14.200 to before 4.15Affected
4.19.149 to before 4.20Affected
5.4.69 to before 5.5Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.