Medium 5.5Published Jun 24, 2026

CVE-2026-52963ALSA: usb-audio: Bound MIDI endpoint descriptor scans

Updated under an hour ago (Oct 27, 2026, 12:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan. Stop walking when bLength is zero or extends past the remaining endpoint-extra scan.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 5c6cd7021a05a02fcf37f360592d7c18d4d807fb before e2f1260a056eb3215c13c48c5378f3e4112dc3af; from 5c6cd7021a05a02fcf37f360592d7c18d4d807fb before c65b137d351e21cbc5630e73ef0eb1e1d75f5b20; from 5c6cd7021a05a02fcf37f360592d7c18d4d807fb before 728ab0c72e49ca27185067984cd565425eb69b2e; 5c6cd7021a05a02fcf37f360592d7c18d4d807fb builds before 3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e; from 5c6cd7021a05a02fcf37f360592d7c18d4d807fb before a0226560540c16717efcceaf15c862cf115b01d3; from 5c6cd7021a05a02fcf37f360592d7c18d4d807fb before 09141583bd97f4bbd7358e29fd138fe798467cdb; from 5c6cd7021a05a02fcf37f360592d7c18d4d807fb before c59159ce10e75b568cd0d4b29efcb0fb0ddecc94; from 5c6cd7021a05a02fcf37f360592d7c18d4d807fb before d6854daa67be623860f4e1873fd3d3c275aba4ed; and 10 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 4.4.238 before 4.5; from 4.9.238 before 4.10; from 4.14.200 before 4.15; from 4.19.149 before 4.20; from 5.4.69 before 5.5; from 5.7 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e2f1260a056eb3215c13c48c5378f3e4112dc3af	patch
https://git.kernel.org/stable/c/c65b137d351e21cbc5630e73ef0eb1e1d75f5b20	patch
https://git.kernel.org/stable/c/728ab0c72e49ca27185067984cd565425eb69b2e	patch
https://git.kernel.org/stable/c/3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e	patch
https://git.kernel.org/stable/c/a0226560540c16717efcceaf15c862cf115b01d3	patch
https://git.kernel.org/stable/c/09141583bd97f4bbd7358e29fd138fe798467cdb	patch
https://git.kernel.org/stable/c/c59159ce10e75b568cd0d4b29efcb0fb0ddecc94	patch
https://git.kernel.org/stable/c/d6854daa67be623860f4e1873fd3d3c275aba4ed	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.