{"id":"CVE-2026-74499","summary":"ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()\n\nsnd_usbmidi_akai_output() computes its fill-loop bound\n\n\tbuf_end = ep-\u003emax_transfer - MAX_AKAI_SYSEX_LEN - 1;\n\nas a signed int, so a small device-advertised bulk-OUT max_transfer\nmakes buf_end negative.  The loop guard then compares the u32\nurb-\u003etransfer_buffer_length against that negative int: the usual\narithmetic conversion turns buf_end into a large unsigned value, so the\nguard stays true and each iteration keeps appending SysEx framing and\npayload bytes past the end of the URB transfer buffer, which is only\nmax_transfer bytes long.\n\nA USB device that advertises a tiny bulk-OUT endpoint can therefore\ntrigger an attacker-length- and content-controlled heap out-of-bounds\nwrite when a process writes to the created /dev/snd/midiC*D* node.\n\nReturn early when there is no room for even one SysEx, so the loop is\nnever entered with a bound that would wrap.  The loop is the last\nstatement of the function, so bailing out is equivalent to it not\nrunning.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e","modified":"2026-08-16T03:48:51.719796625Z","published":"2026-08-15T12:27:25.728Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74499.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0970274613fb463d376211450cab066d34ebfe6a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/29a4c29943631301e85f5e9d10f25741bd78e7ba"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2b7a0f330dd90dd1a7657cec0db019ee1efa4372"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9b22a5c8310b0d55d04f5f0159b913a2fb8b444f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74499.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74499"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4434ade8c9334a3ab975d8993de456f06841899e"},{"fixed":"29a4c29943631301e85f5e9d10f25741bd78e7ba"},{"fixed":"9b22a5c8310b0d55d04f5f0159b913a2fb8b444f"},{"fixed":"b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081"},{"fixed":"2b7a0f330dd90dd1a7657cec0db019ee1efa4372"},{"fixed":"0970274613fb463d376211450cab066d34ebfe6a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74499.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.35"},{"fixed":"6.6.151"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74499.json"}}],"schema_version":"1.9.0"}