In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: fix OOB write in sndusbmidinovation_output()
sndusbmidinovationoutput() lays out a two-byte header at transferbuffer[0..1] and passes &transferbuffer[2] together with a length of ep->maxtransfer - 2 to sndrawmiditransmit():
count = snd_rawmidi_transmit(ep->ports[0].substream,
&transfer_buffer[2],
ep->max_transfer - 2);
ep->maxtransfer comes from the output endpoint's wMaxPacketSize via usbmaxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->max_transfer becomes 1 and the count argument becomes -1.
sndrawmiditransmit() passes the negative count on to _sndrawmiditransmitpeek(), where "if (count1 > count) count1 = count" leaves count1 negative; getalignedsize() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (sizet)-1 length and writes far past the transfer buffer, which was allocated with usballoccoherent(ep->maxtransfer).
This is the same class of bug that was fixed for sndusbmidiakaioutput() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80829.json"
}