CVE-2026-80829: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80829 Overview

CVE-2026-80829 is an out-of-bounds write vulnerability in the Linux kernel's ALSA USB MIDI subsystem, specifically in the snd_usbmidi_novation_output() function. The flaw arises when a malicious or malformed USB device advertises a bulk OUT endpoint with a wMaxPacketSize of 1. The USB core only clamps this value downward, causing ep->max_transfer - 2 to underflow to -1 when passed as a length argument to snd_rawmidi_transmit(). The negative value is then treated as (size_t)-1 in a subsequent memcpy(), writing far past the coherent transfer buffer allocated with usb_alloc_coherent().

Critical Impact
A physically attached or emulated USB device can trigger kernel memory corruption, potentially leading to denial of service or privilege escalation on affected Linux systems.

Affected Products

Linux kernel — ALSA USB-audio driver (sound/usb/midi.c)
Multiple stable kernel branches referenced in the upstream fix commits
Systems accepting USB device attachment with the snd-usb-audio module loaded

Discovery Timeline

2026-09-04 - CVE-2026-80829 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80829

Vulnerability Analysis

The defect resides in snd_usbmidi_novation_output() within the Linux kernel ALSA USB MIDI driver. The routine constructs a two-byte header at transfer_buffer[0..1] and then invokes snd_rawmidi_transmit() with &transfer_buffer[2] and a length of ep->max_transfer - 2. The ep->max_transfer value is derived from the endpoint's wMaxPacketSize via usb_maxpacket(). When a device reports a wMaxPacketSize of 1, the subtraction produces -1, which is then passed as a signed int count.

Inside __snd_rawmidi_transmit_peek(), the check if (count1 > count) count1 = count fails to reject a negative count. For byte-stream substreams, get_aligned_size() preserves the negative value. The subsequent memcpy(buffer, ..., count1) then interprets the length as (size_t)-1, resulting in a write that vastly exceeds the coherent buffer originally allocated at ep->max_transfer bytes.

This is the same class of bug previously fixed in snd_usbmidi_akai_output() by commit 0970274613fb. The Novation output routine was left unguarded, and the fix adds an early bailout when the endpoint cannot hold the two-byte header plus at least one payload byte.

Root Cause

The root cause is missing validation of the endpoint's wMaxPacketSize. The code assumes ep->max_transfer is greater than the two-byte header, but the USB core does not enforce a minimum. Signed arithmetic on the length permits the value to become negative and propagate into a memcpy() length parameter.

Attack Vector

Exploitation requires the ability to attach a crafted or emulated USB MIDI device to the target system. A device advertising a bulk OUT endpoint with wMaxPacketSize = 1 and matching the Novation quirk path triggers the out-of-bounds write. Attack scenarios include physical USB insertion, malicious peripherals, or emulated USB devices exposed through virtualization or USB-over-IP.

No public proof-of-concept has been published in the referenced advisories. Technical detail is available in the upstream fix commits, including Kernel Commit 1035a8f and Kernel Commit 94e4562f.

Detection Methods for CVE-2026-80829

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN reports referencing snd_usbmidi_novation_output or __snd_rawmidi_transmit_peek.
Kernel log entries showing USB MIDI device enumeration immediately preceding a crash or memory corruption event.
USB device descriptors advertising an unusually small wMaxPacketSize (value of 1) on bulk OUT endpoints.

Detection Strategies

Enable KASAN on test kernels to catch out-of-bounds writes in the ALSA USB MIDI code path during device attachment fuzzing.
Audit kernel versions across the fleet against the fixed commit hashes to identify unpatched hosts.
Correlate USB attach events (udev) with subsequent kernel warnings or crashes involving the snd_usbmidi symbols.

Monitoring Recommendations

Forward dmesg, journald, and auditd USB events to a centralized log platform for correlation and anomaly detection.
Alert on USB device attachments in high-value environments where peripheral connections are not routine.
Track kernel module load events for snd-usb-audio on servers and workstations that should not require audio drivers.

How to Mitigate CVE-2026-80829

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE advisory as soon as vendor rebuilds become available.
Restrict USB device attachment on servers and sensitive endpoints using USB port control policies or usbguard.
Unload the snd-usb-audio module on systems where USB MIDI is not required: modprobe -r snd_usbmidi_lib.

Patch Information

The fix adds an early return in snd_usbmidi_novation_output() when ep->max_transfer is insufficient to hold the two-byte header plus at least one payload byte. Patched commits are available in multiple stable branches, including Kernel Commit 1074c230, Kernel Commit 558fc448, Kernel Commit 7639ec97, Kernel Commit 7f00dbdd, Kernel Commit 91919b3b, Kernel Commit 9c821243, and Kernel Commit e9c00d75. Consult your Linux distribution's security tracker to identify the correct backport version.

Workarounds

Blocklist the snd-usbmidi-lib and snd-usb-audio kernel modules on hosts that do not require USB audio functionality.
Deploy usbguard or equivalent USB access control to allow only known-good vendor and product IDs.
Disable USB ports in BIOS/UEFI or via hardware controls on servers where physical peripheral access is not required.

bash

# Configuration example: blocklist the ALSA USB MIDI module
echo "blacklist snd_usbmidi_lib" | sudo tee /etc/modprobe.d/blacklist-snd-usbmidi.conf
echo "blacklist snd_usb_audio"  | sudo tee -a /etc/modprobe.d/blacklist-snd-usbmidi.conf
sudo update-initramfs -u
sudo modprobe -r snd_usbmidi_lib snd_usb_audio || true