CVE-2026-90033

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write exists in the snd usbmidi us122l output() function. The issue occurs when the function selects a count of 2 for devices slower than high speed without verifying it against ep->max transfer. If a device declares a one-byte bulk endpoint, the system takes two bytes from snd rawmidi transmit(), causing the memset operation used for padding to compute a negative value (1 - 2), which wraps to SIZE MAX and leads to an out-of-bounds write in the URB buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.