CVE-2026-90033 Overview
CVE-2026-90033 is an out-of-bounds write vulnerability in the Linux kernel's ALSA usb-audio subsystem, specifically in the snd_usbmidi_us122l_output() function. The flaw affects USB MIDI output handling for US-122L class devices operating at speeds slower than USB high speed. The function fixes a transfer count of 2 without validating it against the endpoint's max_transfer size. When a device declares a bulk endpoint smaller than 2 bytes, the padding memset computes 1 - 2 as an unsigned integer, wrapping to SIZE_MAX and triggering an out-of-bounds write beyond the URB buffer.
Critical Impact
A malicious or malformed USB device can trigger kernel memory corruption by declaring a one-byte bulk endpoint, causing kernel heap corruption through a SIZE_MAXmemset operation.
Affected Products
- Linux kernel — ALSA usb-audio driver (snd-usb-us122l MIDI output path)
- Devices routed through the default US-122L output op, including the US-122MKII (USB ID 0x0644:0x8021)
- Any host system exposing the affected driver to untrusted USB devices operating below high speed
Discovery Timeline
- 2026-09-16 - CVE-2026-90033 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90033
Vulnerability Analysis
The defect resides in the USB MIDI output path for US-122L class devices in the Linux kernel ALSA usb-audio driver. snd_usbmidi_us122l_output() unconditionally picks a transfer count of 2 on any USB speed slower than high speed. This hard-coded count is never bounded against the endpoint's ep->max_transfer field, which represents the actual URB buffer capacity. When the device advertises a bulk endpoint with wMaxPacketSize smaller than 2 bytes, the function reads two bytes from snd_rawmidi_transmit() into a one-byte buffer. The subsequent memset that zero-pads the remainder of the buffer computes its length as max_transfer - count, which underflows in unsigned arithmetic. This classifies as an Out-of-Bounds Write and an Integer Underflow.
Root Cause
The root cause is missing input validation between a driver-chosen fixed transfer count and the endpoint's declared max_transfer. Only product IDs 0x800e and 0x800f are pinned to a nine-byte transfer size. Other devices, including the US-122MKII at 0x0644:0x8021, fall through to a default path that trusts usb_maxpacket(). The USB core only clamps that value downward, so a one-byte endpoint descriptor is accepted as-is. The unsigned subtraction max_transfer - count then wraps to SIZE_MAX, driving memset past the URB buffer bounds and corrupting adjacent kernel heap memory.
Attack Vector
Exploitation requires the ability to attach a USB device to a vulnerable host, or to emulate one through a compromised peripheral or gadget stack. The attacker crafts a device descriptor that reports a slower-than-high-speed connection and advertises a bulk MIDI endpoint with wMaxPacketSize of 1. When userspace writes to the raw MIDI interface, the driver triggers the vulnerable output path, and the wrapped memset corrupts kernel heap memory. This creates the conditions for denial of service and, depending on adjacent allocations, potential privilege escalation. The vulnerability is analogous to earlier fixes applied to the akai and novation output ops in the same file, which received the identical guard against unbounded transfer counts.
Refer to the upstream kernel commit series for the exact patch that clamps the transfer count against ep->max_transfer before memset executes.
Detection Methods for CVE-2026-90033
Indicators of Compromise
- Kernel oops or KASAN: slab-out-of-bounds reports referencing snd_usbmidi_us122l_output in the call stack
- Unexpected usb-audio or snd-usb-us122l driver crashes coinciding with USB device connection events
- USB device enumeration logs showing MIDI bulk endpoints with wMaxPacketSize values of 1 or 2 at low or full speed
Detection Strategies
- Audit dmesg and journald for ALSA usb-audio warnings or panics tied to US-122L class device IDs
- Correlate USB attach events (udev, usbmon) with kernel memory-corruption diagnostics from KASAN-enabled builds
- Inventory kernel builds against the fixed commits listed in the NVD references to identify unpatched hosts
Monitoring Recommendations
- Enable KASAN or KFENCE on lab and pre-production kernels to surface out-of-bounds writes early
- Alert on new or unauthorized USB VID/PID enumerations, especially devices matching the 0x0644 vendor range
- Track kernel version drift across the fleet and prioritize hosts exposed to untrusted USB ports (kiosks, shared workstations)
How to Mitigate CVE-2026-90033
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in NVD to the affected snd-usb-us122l driver
- Rebuild and redeploy kernels on any distribution that has not yet incorporated the stable backports
- Restrict physical and virtual USB access on high-value hosts until patched kernels are in place
Patch Information
The upstream fix mirrors the guard previously applied to the akai and novation output ops in the same source file: the transfer count is clamped against ep->max_transfer before the memset runs. The corrective commits are tracked across the stable trees at 1d4add2, 2dae0e3, 5538daf, 9392a2c, 9d81885, a441a8e, de6d252, and e4637ce. Consumers of long-term support kernels should confirm the fix is present in their vendor build before deployment.
Workarounds
- Blacklist the snd-usb-us122l module on systems that do not require US-122L MIDI hardware using modprobe configuration
- Enforce USB device allow-lists via udev rules or USBGuard to block unknown MIDI-class devices
- Disable USB ports on unattended endpoints through BIOS or endpoint management policy where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
