CVE-2026-52963 - Vulnerability Details

- ALSA: usb-audio: Bound MIDI endpoint descriptor scans

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Bound MIDI endpoint descriptor scans

snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint
descriptor size before using baAssocJackID[], but the descriptor walker can
still return a class-specific endpoint descriptor whose bLength exceeds the
remaining bytes in the endpoint-extra scan.

That leaves later flexible-array reads bounded by bLength, but not by the
remaining bytes in the endpoint-extra scan.

Stop walking when bLength is zero or
extends past the remaining endpoint-extra scan.

Published: 2026-06-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5c6cd7021a05a02fcf37f360592d7c18d4d807fb`	affected	< e2f1260a056eb3215c13c48c5378f3e4112dc3af
`5c6cd7021a05a02fcf37f360592d7c18d4d807fb`	affected	< c65b137d351e21cbc5630e73ef0eb1e1d75f5b20
`5c6cd7021a05a02fcf37f360592d7c18d4d807fb`	affected	< 728ab0c72e49ca27185067984cd565425eb69b2e
`5c6cd7021a05a02fcf37f360592d7c18d4d807fb`	affected	< 3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e
`5c6cd7021a05a02fcf37f360592d7c18d4d807fb`	affected	< a0226560540c16717efcceaf15c862cf115b01d3
`5c6cd7021a05a02fcf37f360592d7c18d4d807fb`	affected	< 09141583bd97f4bbd7358e29fd138fe798467cdb
`5c6cd7021a05a02fcf37f360592d7c18d4d807fb`	affected	< c59159ce10e75b568cd0d4b29efcb0fb0ddecc94
`5c6cd7021a05a02fcf37f360592d7c18d4d807fb`	affected	< d6854daa67be623860f4e1873fd3d3c275aba4ed
`9e0c71f2f633b0442661966228827d1a33df485f`	affected	—
`0868bc5654c07628c421547f0821650a8c2cb8f3`	affected	—
`78483c1c7741ffa72991d93d19a75bfdcc2cbf57`	affected	—
`65d95462001c6ccd9bc9499c1fc9a90eca9de496`	affected	—
`ca767cf0152d18fc299cde85b18d1f46ac21e1ba`	affected	—
`4.4.238`	affected	< 4.5
`4.9.238`	affected	< 4.10
`4.14.200`	affected	< 4.15
`4.19.149`	affected	< 4.20
`5.4.69`	affected	< 5.5

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5c6cd7021a05a02fcf37f360592d7c18d4d807fb,e2f1260a056eb3215c13c48c5378f3e4112dc3af)`	affected	code_commit	—
`[5c6cd7021a05a02fcf37f360592d7c18d4d807fb,c65b137d351e21cbc5630e73ef0eb1e1d75f5b20)`	affected	code_commit	—
`[5c6cd7021a05a02fcf37f360592d7c18d4d807fb,728ab0c72e49ca27185067984cd565425eb69b2e)`	affected	code_commit	—
`[5c6cd7021a05a02fcf37f360592d7c18d4d807fb,3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e)`	affected	code_commit	—
`[5c6cd7021a05a02fcf37f360592d7c18d4d807fb,a0226560540c16717efcceaf15c862cf115b01d3)`	affected	code_commit	—
`[5c6cd7021a05a02fcf37f360592d7c18d4d807fb,09141583bd97f4bbd7358e29fd138fe798467cdb)`	affected	code_commit	—
`[5c6cd7021a05a02fcf37f360592d7c18d4d807fb,c59159ce10e75b568cd0d4b29efcb0fb0ddecc94)`	affected	code_commit	—
`[5c6cd7021a05a02fcf37f360592d7c18d4d807fb,d6854daa67be623860f4e1873fd3d3c275aba4ed)`	affected	code_commit	—
`9e0c71f2f633b0442661966228827d1a33df485f`	affected	code_commit	—
`0868bc5654c07628c421547f0821650a8c2cb8f3`	affected	code_commit	—
`78483c1c7741ffa72991d93d19a75bfdcc2cbf57`	affected	code_commit	—
`65d95462001c6ccd9bc9499c1fc9a90eca9de496`	affected	code_commit	—
`ca767cf0152d18fc299cde85b18d1f46ac21e1ba`	affected	code_commit	—
`[4.4.238,4.5)`	affected	semver	—
`[4.9.238,4.10)`	affected	semver	—
`[4.14.200,4.15)`	affected	semver	—
`[4.19.149,4.20)`	affected	semver	—
`[5.4.69,5.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	semver	—
`[0,5.7)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.141,6.7.0)`	unaffected	semver	—
`[6.12.91,6.13.0)`	unaffected	semver	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/09141583bd97f4bbd7358e29fd138fe798467cdb
https://git.kernel.org/stable/c/3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e
https://git.kernel.org/stable/c/728ab0c72e49ca27185067984cd565425eb69b2e
https://git.kernel.org/stable/c/a0226560540c16717efcceaf15c862cf115b01d3
https://git.kernel.org/stable/c/c59159ce10e75b568cd0d4b29efcb0fb0ddecc94
https://git.kernel.org/stable/c/c65b137d351e21cbc5630e73ef0eb1e1d75f5b20
https://git.kernel.org/stable/c/d6854daa67be623860f4e1873fd3d3c275aba4ed
https://git.kernel.org/stable/c/e2f1260a056eb3215c13c48c5378f3e4112dc3af
https://lore.kernel.org/linux-cve-announce/2026062437-CVE-2026-52963-2264@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52963
https://www.cve.org/CVERecord?id=CVE-2026-52963

History

Sat, 27 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062437-CVE-2026-52963-2264@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52963 https://www.cve.org/CVERecord?id=CVE-2026-52963
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 24 Jun 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan. Stop walking when bLength is zero or extends past the remaining endpoint-extra scan.
Title		ALSA: usb-audio: Bound MIDI endpoint descriptor scans
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/09141583bd97f4bbd7358e29fd138fe798467cdb https://git.kernel.org/stable/c/3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e https://git.kernel.org/stable/c/728ab0c72e49ca27185067984cd565425eb69b2e https://git.kernel.org/stable/c/a0226560540c16717efcceaf15c862cf115b01d3 https://git.kernel.org/stable/c/c59159ce10e75b568cd0d4b29efcb0fb0ddecc94 https://git.kernel.org/stable/c/c65b137d351e21cbc5630e73ef0eb1e1d75f5b20 https://git.kernel.org/stable/c/d6854daa67be623860f4e1873fd3d3c275aba4ed https://git.kernel.org/stable/c/e2f1260a056eb3215c13c48c5378f3e4112dc3af

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:28:43.593Z

Updated: 2026-06-24T16:28:43.593Z

Reserved: 2026-06-09T07:44:35.374Z

Link: CVE-2026-52963

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52963 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-27T02:30:03Z

Weaknesses

CWE-125

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object