CVE-2026-52963: Linux ALSA USB Audio MIDI Descriptor Bounds Check Vulnerability

Technical summary

CVE-2026-52963 affects snd_usbmidi_get_ms_info() in the ALSA USB audio subsystem. The function validates baAssocJackID[] array access within class-specific MIDIStreaming endpoint descriptors, but the descriptor walker loop lacks proper bounds checking on the bLength field. A descriptor with bLength set to zero or a value exceeding remaining bytes in the endpoint-extra scan can trigger out-of-bounds reads during flexible-array member access. The vulnerability exists because validation occurs on internal descriptor size but not on the relationship between bLength and the actual remaining scan buffer, violating the contract of bounded iteration.

Business impact

This vulnerability enables local denial of service attacks against Linux systems. An unprivileged user with physical USB device access or the ability to modify USB device firmware can trigger a kernel panic, causing system downtime and service interruption. This is particularly concerning for shared computing environments, kiosks, or systems accepting untrusted USB peripherals. No data exfiltration or privilege escalation occurs, but availability impact is severe for affected deployments.

Affected systems

All versions of the Linux kernel prior to the security fix are affected. The vulnerability resides in core ALSA USB audio handling, making it present across all architectures and distributions using vulnerable kernel versions. Systems with USB audio device support enabled are at risk; headless or embedded systems with USB audio disabled are unaffected.

Exploitability

Exploitation requires local access and the ability to present a malicious USB device to the target system. No authentication is needed, and no user interaction beyond device connection is required. The attack surface is limited to systems accepting untrusted USB peripherals. The CVSS score of 5.5 (Medium) reflects local-only attack vector, low privilege requirement, and denial-of-service impact without data compromise. Real-world exploitation difficulty is moderate—crafting a valid yet malicious USB descriptor requires knowledge of USB MIDI protocols but is achievable through widely available USB fuzzing tools.

Remediation

The fix adds explicit bounds checking to ensure the descriptor walker terminates when bLength is zero or would extend past the remaining bytes in the endpoint-extra scan buffer. This prevents out-of-bounds reads by enforcing that all descriptor field accesses respect both the declared length and available memory. Patched kernels include this validation prior to any flexible-array member access.

Patch guidance

Apply the latest stable or long-term support kernel version from your distribution. Verify that your kernel update includes the ALSA USB audio descriptor bounds check. Most major distributions (Red Hat, Debian, Ubuntu, SUSE) have released updates; check your vendor's security advisory for specific version numbers and timelines. Compile a custom kernel with the upstream fix if using unsupported branches. Verify the fix is present by confirming the snd_usbmidi_get_ms_info() function includes the bLength validation loop termination logic.

Detection guidance

Monitor system logs for kernel crashes (kernel panic, oops) occurring during USB device connection or enumeration, particularly when audio devices are attached. Audit USB device connection events in dmesg. On systems with kernel debugging enabled, look for out-of-bounds read warnings from KASAN (Kernel Address Sanitizer) in snd_usbmidi_get_ms_info(). Intrusion detection systems can flag suspicious USB descriptor patterns, though this requires deep USB protocol inspection. Practical detection focuses on post-exploitation crash analysis rather than prevention.

Why prioritize this

This should be treated as a medium-priority patch for most organizations but elevated for environments accepting untrusted USB devices (public terminals, BYOD labs, shared workstations). The local-only attack vector and denial-of-service impact (no data breach risk) place it below remote code execution vulnerabilities but above cosmetic bugs. Prioritize patching for internet-facing Linux infrastructure and edge devices with USB exposure; internal-only headless servers are lower priority.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: (1) Local attack vector—physical USB access or OS-level account required; (2) Low complexity—no special conditions beyond device connection; (3) Low privilege—unprivileged user sufficient; (4) No confidentiality or integrity impact—denial of service only; (5) High availability impact—kernel crash and system unavailability. The score appropriately penalizes availability damage while acknowledging the significant barrier of local access requirement.

Frequently asked questions