CVE-2026-74499

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

snd_usbmidi_akai_output() computes its fill-loop bound

buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1;

as a signed int, so a small device-advertised bulk-OUT max_transfer

makes buf_end negative. The loop guard then compares the u32

urb->transfer_buffer_length against that negative int: the usual

arithmetic conversion turns buf_end into a large unsigned value, so the

guard stays true and each iteration keeps appending SysEx framing and

payload bytes past the end of the URB transfer buffer, which is only

max_transfer bytes long.

A USB device that advertises a tiny bulk-OUT endpoint can therefore

trigger an attacker-length- and content-controlled heap out-of-bounds

write when a process writes to the created /dev/snd/midiC*D* node.

Return early when there is no room for even one SysEx, so the loop is

never entered with a bound that would wrap. The loop is the last

statement of the function, so bailing out is equivalent to it not

running.

Discovered by XBOW, triaged by Baul Lee <[email protected]>