Linux Kernel EUVD-2026-38832

The affected component is the ALSA USB audio MIDI 2.0 endpoint descriptor parser within the Linux kernel (cpe:2.3:a:linux:linux), introduced around Linux 6.5. When the kernel enumerates USB audio class devices, it walks endpoint extra descriptors to parse MIDI 2.0 group terminal block associations stored in the baAssoGrpTrmBlkID[] array. The parser performs a length check of bLength against bNumGrpTrmBlock (the declared count of group terminal block IDs) prior to reading the array, but fails to additionally validate against the remaining bytes actually available in the current endpoint-extra scan window. A malicious USB device presenting a descriptor where bLength is inconsistent with remaining scan bytes can therefore cause reads to consume kernel memory beyond the legitimate descriptor buffer - a classic out-of-bounds read pattern analogous to CWE-125. The fix enforces rejection of both zero-length and overlong descriptors at the walking stage, mirroring the bounds-check pattern already applied in the legacy MIDI parser. The intelligence tags flag 'Information Disclosure', consistent with out-of-bounds reads potentially exposing adjacent kernel memory, though the NVD CVSS vector records C:N - a discrepancy worth noting.