CVE-2026-52963: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52963 Overview

CVE-2026-52963 is a vulnerability in the Linux kernel's ALSA USB-audio driver. The flaw resides in snd_usbmidi_get_ms_info(), which parses MIDIStreaming endpoint descriptors from USB devices. The function validates the internal descriptor size before reading baAssocJackID[], but the descriptor walker can return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. Subsequent flexible-array reads are bounded by bLength rather than by the actual remaining buffer. This permits an out-of-bounds read of kernel memory triggered by a crafted or malicious USB MIDI device.

Critical Impact
A malicious or malformed USB MIDI device can trigger an out-of-bounds read in the kernel ALSA driver, leading to information disclosure or kernel instability when the device is enumerated.

Affected Products

Linux kernel (mainline) versions containing snd_usbmidi_get_ms_info() prior to the fix
Stable kernel branches referenced in the upstream commit set
Linux distributions shipping the affected ALSA USB-audio driver

Discovery Timeline

2026-06-24 - CVE-2026-52963 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52963

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the ALSA USB-audio MIDI parsing code path. snd_usbmidi_get_ms_info() iterates over class-specific endpoint descriptors returned by the kernel's USB descriptor walker. While the function verifies the size of the MIDIStreaming endpoint descriptor before accessing baAssocJackID[], the walker itself can yield a descriptor whose declared bLength extends past the end of the endpoint-extra buffer.

Later reads of flexible-array members use bLength as the upper bound. Because bLength is attacker-controlled through the USB descriptor payload, the parser can read beyond the allocated buffer. The fix terminates the walk when bLength is zero or when it extends past the remaining endpoint-extra scan length.

Root Cause

The root cause is missing bounds enforcement during descriptor enumeration. The descriptor walker trusts the device-reported bLength field without cross-checking it against the remaining buffer length supplied by the USB stack. The parser then dereferences flexible-array data within an oversized descriptor, reading past the legitimate endpoint-extra region.

Attack Vector

Exploitation requires the attacker to present a crafted USB device that advertises a MIDI interface with a malformed class-specific endpoint descriptor. When the kernel enumerates the device, the ALSA USB-audio driver parses the malicious descriptor and performs the out-of-bounds read. Physical or local USB access is required, including scenarios involving programmable USB hardware such as malicious peripherals or BadUSB-style devices.

No verified public exploit code is available. The vulnerability is described in the upstream Linux kernel commits referenced in the stable tree.

Detection Methods for CVE-2026-52963

Indicators of Compromise

Kernel log entries from the snd-usb-audio or snd-usbmidi-lib modules reporting malformed descriptors or oops traces during USB device enumeration
KASAN reports flagging out-of-bounds reads in snd_usbmidi_get_ms_info() on kernels built with address sanitizer
Unexpected USB MIDI device connections on servers, kiosks, or workstations that do not normally use audio hardware

Detection Strategies

Audit running kernel versions against the fixed stable releases listed in the upstream commits
Monitor dmesg and journald for ALSA-related warnings, panics, or descriptor parsing errors correlated with USB hotplug events
Correlate USB device insertion events from udev with kernel subsystem errors to identify suspicious peripherals

Monitoring Recommendations

Centralize kernel logs and USB enumeration events for hosts handling sensitive workloads
Alert on repeated USB device connection failures or kernel module faults tied to snd_usbmidi
Track endpoints with USB ports exposed in public or shared physical environments for anomalous device classes

How to Mitigate CVE-2026-52963

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commits for CVE-2026-52963
Update to a distribution kernel release that incorporates the fix once vendors publish advisories
Restrict physical USB access on systems where untrusted peripherals could be attached

Patch Information

The issue is resolved by bounding the MIDIStreaming endpoint descriptor walker. The fix stops iteration when bLength is zero or when it extends past the remaining bytes in the endpoint-extra scan. Patches are available in the upstream Linux kernel tree across multiple stable branches, including commits 09141583bd97, 3d3b2b01a3e7, 728ab0c72e49, a0226560540c, c59159ce10e7, c65b137d351e, d6854daa67be, and e2f1260a056e.

Workarounds

Blacklist the snd-usb-audio and snd-usbmidi-lib kernel modules on systems that do not require USB audio or MIDI support
Apply USB device authorization policies via udev rules to restrict allowed device classes
Disable USB ports physically or through firmware on hardened systems

bash

# Blacklist ALSA USB MIDI modules until the kernel is patched
echo 'blacklist snd_usbmidi_lib' | sudo tee /etc/modprobe.d/blacklist-snd-usbmidi.conf
echo 'blacklist snd_usb_audio' | sudo tee -a /etc/modprobe.d/blacklist-snd-usbmidi.conf
sudo update-initramfs -u

# Restrict USB device authorization (deny by default, allow specific devices)
echo 0 | sudo tee /sys/bus/usb/devices/usb*/authorized_default