CVE-2026-80829

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

snd_usbmidi_novation_output() lays out a two-byte header at

transfer_buffer[0..1] and passes &transfer_buffer[2] together with a

length of ep->max_transfer - 2 to snd_rawmidi_transmit():

count = snd_rawmidi_transmit(ep->ports[0].substream,

&transfer_buffer[2],

ep->max_transfer - 2);

ep->max_transfer comes from the output endpoint's wMaxPacketSize via

usb_maxpacket(). A malformed or malicious device can advertise a bulk

OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this

value downwards - so ep->max_transfer becomes 1 and the count argument

becomes -1.

snd_rawmidi_transmit() passes the negative count on to

__snd_rawmidi_transmit_peek(), where "if (count1 > count) count1 = count"

leaves count1 negative; get_aligned_size() keeps it negative for a

byte-stream substream, so the following memcpy(buffer, ..., count1) ru

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References