Skip to main content

Linux Kernel EUVDEUVD-2026-38831

| CVE-2026-52963 MEDIUM
2026-06-24 Linux GHSA-m4vx-wp7v-hx3x
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack via crafted USB device requiring only low privileges; sole confirmed impact is kernel availability loss with no demonstrated confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:56 vuln.today
CVSS changed
Jul 14, 2026 - 16:22 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Bound MIDI endpoint descriptor scans

snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan.

That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan.

Stop walking when bLength is zero or extends past the remaining endpoint-extra scan.

AnalysisAI

Out-of-bounds read in the Linux kernel's ALSA USB MIDI subsystem (snd_usbmidi_get_ms_info()) allows a local attacker to trigger a kernel panic and denial of service by presenting a crafted USB MIDI device with a malformed endpoint descriptor bLength field. The descriptor walker fails to verify that bLength stays within the remaining endpoint-extra scan bytes, leaving flexible-array reads of baAssocJackID[] potentially unbounded by the actual buffer limit. No public exploit is identified at time of analysis, and EPSS places exploitation probability at 0.18% (8th percentile), consistent with the local attack vector.

Technical ContextAI

The vulnerability resides in snd_usbmidi_get_ms_info() within the Linux kernel's ALSA USB audio driver (sound/usb/midi.c). This function parses MIDIStreaming class-specific endpoint descriptors as defined in the USB MIDI Class specification (Class B.6.2). The endpoint-extra scan walks class-specific endpoint descriptors using bLength as the stride. While the function validates the total MIDIStreaming endpoint descriptor size before indexing the baAssocJackID[] flexible array, the walker does not enforce that bLength remains within the remaining bytes of the scan buffer. A descriptor with a crafted or corrupted bLength - either zero or exceeding the scan limit - bypasses this constraint. The resulting flexible-array read maps to CWE-125 (Out-of-Bounds Read), though no formal CWE is assigned in the NVD record. CPE data (cpe:2.3:a:linux:linux:*) confirms the flaw spans all maintained Linux stable branches from approximately 4.4.x through pre-fix 7.x. The ALSA USB audio module (snd-usb-audio) is loaded on-demand when any USB audio or MIDI device is connected, making the vulnerable parsing path reachable by any user who can present such a device to the kernel.

RemediationAI

Vendor-released patches are available across all actively maintained Linux stable branches: upgrade to 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1. Upstream fix commits are published at https://git.kernel.org/stable/c/e2f1260a056eb3215c13c48c5378f3e4112dc3af and sibling stable backports (c65b137d, 728ab0c7, 3d3b2b01, a0226560, 09141583, c59159ce, d6854daa). Ubuntu users should apply updates per USN-8568-1, USN-8567-1, and USN-8566-1 at https://ubuntu.com/security/notices/. If immediate patching is not feasible, a targeted compensating control is to block the snd-usb-audio kernel module from loading via a modprobe blacklist entry (blacklist snd-usb-audio in /etc/modprobe.d/), which prevents the vulnerable code path from being reached but disables all USB audio and MIDI functionality - weigh this trade-off against operational requirements. Alternatively, USB device access controls via USBGuard can restrict which USB devices are authorized on sensitive systems, reducing the attack surface without fully disabling USB audio class support.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

EUVD-2026-38831 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy