« Volver al listado

CVE-2026-90033

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()

The snd_usbmidi_us122l_output() picks a count of 2 on anything slower than high speed and never relates it to ep->max_transfer. The URB buffer holds exactly max_transfer bytes, so a device declaring a one byte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the memset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX.

Only 0x800e and 0x800f are pinned to nine bytes. The US-122MKII at 0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the USB core only clamps downward.

Leer descripción completaMostrar menos

The akai and novation output ops in this file were given the same guard recently. Do the same here.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90033",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "lessThan": "5538daf2a5cc80ac3f3e913c0db045d92d995d40",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "lessThan": "a441a8e52148c91c2f2a91f42e3b9bc961a13a4b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "lessThan": "2dae0e3a59e31f78222279d544b98e747cd1fbff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "lessThan": "1d4add2b832b56f81bb0eab065ec35c610343018",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "lessThan": "de6d252f115be887a701c09a05cdb076f3a590c9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "lessThan": "9392a2c346762ffee8edd1ba8bac50d2e24a2ed7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "lessThan": "9d81885d97cba7796d1f8edc88f2499c8296f5b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "lessThan": "e4637ce34607f1733a34a57294966d26b263e626",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "sound/usb/midi.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.28",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "sound/usb/midi.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T11:17:16.437",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1d4add2b832b56f81bb0eab065ec35c610343018",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2dae0e3a59e31f78222279d544b98e747cd1fbff",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5538daf2a5cc80ac3f3e913c0db045d92d995d40",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9392a2c346762ffee8edd1ba8bac50d2e24a2ed7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9d81885d97cba7796d1f8edc88f2499c8296f5b9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a441a8e52148c91c2f2a91f42e3b9bc961a13a4b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/de6d252f115be887a701c09a05cdb076f3a590c9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e4637ce34607f1733a34a57294966d26b263e626",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()\n\nThe snd_usbmidi_us122l_output() picks a count of 2 on anything slower\nthan high speed and never relates it to ep->max_transfer.  The URB\nbuffer holds exactly max_transfer bytes, so a device declaring a one\nbyte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the\nmemset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX.\n\nOnly 0x800e and 0x800f are pinned to nine bytes.  The US-122MKII at\n0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the\nUSB core only clamps downward.\n\nThe akai and novation output ops in this file were given the same guard\nrecently.  Do the same here."
    }
  ],
  "lastModified": "2026-09-16T11:17:16.437",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}