CVE-2026-74499

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap out-of-bounds write exists in the ALSA usb-audio component. The function snd usbmidi akai output() calculates a loop bound using a signed integer. If a USB device advertises a very small max transfer value for its bulk-OUT endpoint, the resulting bound becomes negative. Due to arithmetic conversion, this negative value is treated as a large unsigned integer during comparison with urb->transfer buffer length. This allows an attacker to trigger a write operation that exceeds the URB transfer buffer limits when writing to the /dev/snd/midiC*D* node, enabling control over the length and content of the write.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.