CVE-2026-74499

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

snd_usbmidi_akai_output() computes its fill-loop bound

buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1;

as a signed int, so a small device-advertised bulk-OUT max_transfer

makes buf_end negative. The loop guard then compares the u32

urb->transfer_buffer_length against that negative int: the usual

arithmetic conversion turns buf_end into a large unsigned value, so the

guard stays true and each iteration keeps appending SysEx framing and

payload bytes past the end of the URB transfer buffer, which is only

max_transfer bytes long.

A USB device that advertises a tiny bulk-OUT endpoint can therefore

trigger an attacker-length- and content-controlled heap out-of-bounds

write when a process writes to the created /dev/snd/midiC*D* node.

Return early when there is no room for even one SysEx, so the loop is

never entered with a bound that would wrap. The lo

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References