Out-of-Bounds Write Vulnerability in Linux Kernel's USB Audio Interface

CVE-2026-90033

What is CVE-2026-90033?

An out-of-bounds write vulnerability exists within the Linux kernel's USB audio interface, specifically in the snd_usbmidi_us122l_output() function. This issue arises when devices with slower than high-speed connections improperly calculate buffer sizes, potentially leading to memory corruption. The function erroneously allows the transmission of more bytes than the maximum transfer size, risking buffer overflows, which can be exploited by malicious audio devices. Users of affected audio interfaces, including the US-122MKII, are urged to update to the latest kernel versions to mitigate this risk.

References