CVE-2026-52964

The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It validates bLength against bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the remaining bytes in the endpoint-extra scan.

A malformed device can therefore make later baAssoGrpTrmBlkID[] reads consume bytes past the walked descriptor.

Reject zero-length and overlong descriptors while walking endpoint extras.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52964.json",
    "cna_assigner": "Linux"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

ff49d1df79aef7580fe3ac99d17c3f886655d080

Fixed

fafc97bd01e4c737eaeafadfdadb1af4bbfa7307

Fixed

a310b4bebda5e4a1b26520c0cc5145ccd6d617e2

Fixed

f9c184a83574549a36ea69b755f650e57d164c78

Fixed

17e76b19de1aff5ff4de64d269290bd1b07a01d3

Fixed

918be519c7876329e1b6e2ea1c59f0b75e792dca

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52964.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.5.0

Fixed

6.6.141

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.91

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.33

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.0.10

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52964.json"