CVE-2026-80973: Linux Kernel ALSA 6fire Buffer Overflow

CVE-2026-80973 Overview

CVE-2026-80973 is an out-of-bounds read vulnerability in the Linux kernel's ALSA snd-usb-6fire driver. The flaw resides in usb6fire_comm_receiver_handler(), which forwards MIDI events using a length byte supplied directly by the USB device without validating the value against the receive buffer size. A malicious or emulated USB device that responds with a MIDI event type of 0x10 and a length of 0xFF triggers a 255-byte read from a 64-byte kzalloc buffer, leaking adjacent kernel slab memory to userspace through the rawmidi read path. The vulnerability was discovered by XBOW and triaged by Baul Lee.

Critical Impact
A rogue USB device plugged into a Linux host can leak up to 193 bytes of adjacent kernel slab memory to userspace when a MIDI input substream is open, enabling kernel information disclosure without user interaction beyond device attachment.

Affected Products

Linux kernel builds including the snd-usb-6fire driver (sound/usb/6fire)
Multiple stable kernel branches patched across eight backport commits
Systems exposing USB ports where a TerraTec DMX 6Fire USB or emulated equivalent can be attached

Discovery Timeline

2026-09-11 - CVE-2026-80973 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80973

Vulnerability Analysis

The defect is an out-of-bounds read [CWE-125] in the USB receive completion handler for the 6fire audio device. The handler inspects rt->receiver_buffer[0] for a MIDI-in event marker (0x10) and then invokes snd_rawmidi_receive() with a pointer at receiver_buffer + 2 and a length taken from the untrusted device byte receiver_buffer[1].

The receiver_buffer is a 64-byte allocation defined by COMM_RECEIVER_BUFSIZE, leaving only 62 bytes after the two-byte header. Because receiver_buffer[1] is a u8, a device can specify any length up to 255, causing snd_rawmidi_receive() to read past the slab allocation. The bytes past the buffer are then handed to userspace through the rawmidi read interface.

A secondary defect is that urb->actual_length is never consulted. A short USB transfer leaves both the type byte and the length byte at their previous values, so the handler operates on stale data from earlier URB completions.

Root Cause

The root cause is missing input validation on data received from a USB device. The driver trusts a device-supplied length field without bounding it against the fixed receive buffer size, and it does not verify that the USB transfer actually delivered the number of bytes claimed in the header.

Attack Vector

The receiver URB is submitted from usb6fire_comm_init() during probe, so the vulnerable read path executes automatically when the device is plugged in. Data reaches userspace only when a MIDI input substream is open, because usb6fire_midi_in_received() calls snd_rawmidi_receive() only when rt->in is set. An attacker with physical access, a malicious USB peripheral, or an emulated device (as demonstrated in the KASAN report on kernel 7.2.0-rc5 arm64) can trigger the disclosure.

Refer to the upstream fix in Kernel Git Commit 466e911 for the corrected boundary logic.

Detection Methods for CVE-2026-80973

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in snd_rawmidi_receive originating from usb6fire_comm_receiver_handler or usb6fire_midi_in_received
Kernel log entries referencing the snd_usb_6fire module after attachment of an untrusted USB device
Unexpected USB device enumeration matching the TerraTec 6fire product/vendor IDs on systems with no legitimate audio interface deployed

Detection Strategies

Enable KASAN in test and pre-production kernels to surface the out-of-bounds read when fuzzing USB peripherals
Audit dmesg for snd_usb_6fire load events on servers, kiosks, and endpoints where USB audio hardware is not expected
Monitor for rawmidi device nodes (/dev/snd/midiC*D*) being opened by unexpected user processes

Monitoring Recommendations

Instrument USB device attachment events through udev and forward them to central logging for anomaly review
Alert on kernel module autoloads for snd-usb-6fire on hosts with USB port restriction policies
Correlate physical access events with kernel module load telemetry to identify unauthorized peripheral use

How to Mitigate CVE-2026-80973

Immediate Actions Required

Apply the stable kernel updates that include the ALSA 6fire bound-check fix on all Linux systems exposing USB ports
Where patching is delayed, blocklist the snd-usb-6fire kernel module on systems that do not require it
Enforce USB device allowlisting on servers, workstations, and shared kiosks to prevent attachment of untrusted peripherals

Patch Information

The fix rejects any MIDI event whose declared length exceeds the bytes following the two-byte header and requires the USB transfer to have delivered the header plus that many bytes. Because the receiver URB is submitted with a 64-byte transfer_buffer_length, legitimate devices cannot exceed 62 payload bytes and no valid data is discarded. Backports are available in Kernel Git Commit 00e84a9, Kernel Git Commit 0c8a3c7, Kernel Git Commit 2a6f6fb, Kernel Git Commit 2c590d5, Kernel Git Commit 34816e2, Kernel Git Commit 466e911, Kernel Git Commit a478893, and Kernel Git Commit c9204bc.

Workarounds

Blacklist the vulnerable module by adding blacklist snd-usb-6fire to /etc/modprobe.d/ on hosts that do not use TerraTec 6fire hardware
Disable autoload with install snd-usb-6fire /bin/true to prevent USB probe events from loading the driver
Use USBGuard or equivalent to restrict which USB devices can attach and enumerate on protected endpoints

bash

# Configuration example
echo 'blacklist snd-usb-6fire' | sudo tee /etc/modprobe.d/blacklist-6fire.conf
echo 'install snd-usb-6fire /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-6fire.conf
sudo update-initramfs -u
sudo modprobe -r snd_usb_6fire 2>/dev/null || true