CVE-2026-80829

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix OOB write in snd usbmidi novation output()

snd usbmidi novation output() lays out a two-byte header at transfer buffer[0..1] and passes &transfer buffer[2] together with a length of ep->max transfer - 2 to snd rawmidi transmit():

count = snd rawmidi transmit(ep->ports[0].substream,
			   &transfer buffer[2],
			   ep->max transfer - 2);

ep->max transfer comes from the output endpoint's wMaxPacketSize via usb maxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->max transfer becomes 1 and the count argument becomes -1.

snd rawmidi transmit() passes the negative count on to snd rawmidi transmit peek(), where "if (count1 > count) count1 = count" leaves count1 negative; get aligned size() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (size t)-1 length and writes far past the transfer buffer, which was allocated with usb alloc coherent(ep->max transfer).

This is the same class of bug that was fixed for snd usbmidi akai output() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in snd usbmidi akai output()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.